FortiGate managed FortiSwitches with Unifi accesspoints

[YISS]

Hello,

I have an issue with my set-up.

I have a FortiGate 40F connected to 1 FortiSwitch 124F and a FortiSwitch 108E-PoE.
My FortiGate (7.4) is physically connected to the FortiSwitch 124 on port 2 and the FortiSwitch 108 (both running 7.4) is connected to port 1. The Fortigate can see both switches, both switches are connected and authorised through the fortilink.

I can manage VLANs and ports on both switches.

I have also 3 Unifi UAP6 Pro accesspoints managed by a Unifi controller on a local server. Those accesspoints used to serve 4 VLANs. I'm saying "used to" because lately I replaced my old Zyxel switch with the FortiSwitch 108. On the first 3 ports I've connected the 3 AP's because of the PoE. I've added a trunk with those 3 ports, allowing all VLANs (1-4094), however no traffic is flowing over the AP's. The first traffic I would like, is to receive DHCP addressing, provided by the Fortilink interfaces.

Can someone provide some guidance?

#FortiGate #FortiSwitch

[hbac · Accepted solution]

Hi @YISS,

Not sure why you trunk those ports. You can just set 'allowed VLANs' to all on those switch ports. Make sure the native VLAN has DHCP server enabled. 

Regards, 

[hbac · Accepted solution]

Hi @YISS,

Not sure why you trunk those ports. You can just set 'allowed VLANs' to all on those switch ports. Make sure the native VLAN has DHCP server enabled. 

Regards, 

[YISS]

Hi hbac,

I've adjusted the ports accordingly. One question remains, the native VLAN for the Wireless AP's needs to be VLAN 1, which is assigned to the default.fortilink interface. I do not use this interface other than for those devices, which already have static IP addresses.
The DHCP server is on a different VLAN, lets say VLAN 1000, which is the VLAN interface of the Fortigate for those networks. Does VLAN1 still need a DHCP server?
YISS

[YISS · Accepted solution]

Another part of the solution was to add an ip address to the interface of the VLAN 1 interface. The APs use that to validate if they are online...