FortiGate as a WLC controller

[GelbertHorn]

Hi guys

Is it possible to have all your FortiAP's and FortiSwitches connected to an FG, but the FG is not the gateway? I.e., have an FG sit on the network just to manage the switches and AP's, or should I rather go for a FortiWLC appliance/vm.

Client currently have a WatchGuard they paid for until 2024 so don't want to rip it out yet. But wants to have a fully managed Fortinet infrastructure. Someone mentioned using a vdom to manage the AP/SW's and then a vwire to pass traffic through, but I have no idea how to do that.

Thanks

[distillednetwork]

The FortiWLC appliance is going away and many of the aps do not work with it.  You also can not manage switch with FortiWLC.

You can absolutely use the fortigate just as a controller for switches and aps.  All you need to do is configure the vlans on the fortiswitch and don't give them IPs, if the watchguard is your router for all your networks.  You can also put the SSIDs in bridge mode then tag the vlan on the switch port or create a software switch on the fortigate to bridge the ssid to the lan port.  

page 83:

https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/6faf47d7-1989-11eb-96b9-005056...

[GelbertHorn]

Thanks, DN, this will be a completely new network, all with new switches and APs, only thing old is the WG, I was thinking of setting up the whole new network, and then just place the WG in front of the FG, with traffic going out to the internet via the WG. Maybe using the WAN port on the FG to forward all internet traffic to the WG?

This way, I will have a complete Fortinet network on the inside, with the WG just doing the internet routing.

Then, once the WG expire, just take it out and have the FG doing internet

[distillednetwork]

Yes, forwarding to the WG as the default route will make it easy to transition it later for sure. That would be a great way to do it.

 Just set up some routes on the WG pointing to the Fortigate with all the new subnets you create on it.