Fortigate 40F - 2 LAN and 2 WLAN networks with same subnets for LAN/WLAN

[Vito1891]

Hi,
I have Fortigate 40F and I need to set 2 LAN and WLAN networks. LAN 1 and WAN 1 should be on the same subnet and same LAN2, WAN2.

LAN 1: VLAN 101 (e.g. 192.168.1.0/24)
LAN 2: VLAN 102 (e.g. 192.168.2.0/24)

WLAN 1: VLAN 101
WLAN 2: VLAN 102

Port A - LAN 2
Port 1 - LAN 1
Port 2 - AP 1 (Ubiquity UAC-AC-Pro)
Port 3 - AP 2 (Ubiquity UAC-AC-Pro)

In normal environment I would add Port 1 to VLAN 101, Port 2 and 3 to VLANs 101, 102 and Port A to VLAN 102. I would set IPs for VLAN 101 and 102 (GWs for both VLANs), but not sure how to set this config on Fortigate. Would you advice?

[DPadula]

Hi Vito1891,

I believe the following document answer your question: How to combine a wireless network and wired LAN with a software switch

Don't forget to mark the answer as solution to help other community members. 

[Vito1891]

Hi DPadula, 

I've revied this document before I posted here, and if I understood well this document, it's not going to work for my requirenments. 

Again this is expected configuration:

Port A - LAN 2, VLAN 102, Port type: access
Port 1 - LAN 1, VLAN 101, Port type: access
Port 2 - AP 1 (Ubiquiti UAC-AC-Pro), Port type: trunk (allowed vlans: 101,102)
Port 3 - AP 2 (Ubiquiti UAC-AC-Pro), Port type: trunk (allowed vlans: 101,102)

Both APs need to broadcast 2 SSIDs (SSID1 in vlan 101, and SSID2 in vlan 102)

For these 2 vlans I have virtual interfaces with IPs within diffrent subnets, with DHCP enabled,  so user from  LAN 1 / WLAN (SSID 1) get IP from subnet 1 and user from LAN 2 / WLAN (SSID 2) get ip from subnet 2.

APs need to be connected directly to Fortigate, as I have only unmanaged L2 switches in my hardware config.

[Toshi_Esumi]

Of course you need to use software switches to combine wired and wireless network in one subnet/DHCP. But if you don't have a switch with PoE but directly hook those APs directly to the 40F using either local power adapters or PoE injectors, you don't have to use VLANs but separate those three ports 1-3 to independent lan1 - lan3 ports by removing from "lan" hard-switch.
Then combine "lan1"(LAN1) and "lan2"(AP1), and "a"(LAN2) and "lan3"(AP2) to two software swiches.

Toshi

[Vito1891]

Hi Toshi,
Thanks for advice, but in your configuration each AP provides only 1 SSID in 1 vlan. I need to have 2 wired vlans (e.g. 101 and 102) and have these vlans in wireless network on both APs (2 SSIDs (SSID 1 = vlan 101, SSID 2 = vlan 102)).

[Toshi_Esumi]

Sorry I gave you a wrong description of operation. Please disregard my last comment.  It's been a while I configured a new tunnel mode SSID last time.

Each tunnel SSID should become an "interface" as type:vap-interface (Go to interface view in GUI, or "config sys int" then "show" in CLI to see them). So that you can put the SSID and physical interface, like lan1, together into one software switch interface.
Those lan2 and lan3 physical interfaces are the termiation point of FAP's management interface. Tunnel mode SSIDs are NOT bound to those physical/management interfaces (coming to the physical interface over CAPWAP tunnel).

Toshi 

[Toshi_Esumi]

Ok, I missed your point again. They're Ubiquity's not FAPs. Then it wouldn't work that way. So, it's not possible to create a software switch to bind SSID. Those SSIDs need to come over different VLANs, like VLAN 103 and 104. Then you can bind 101-103 and 102-104 as software switches.
Then I don't see any point separating physical interfaces if you have switches to handle LAN VLANs, 101 and 102. Why don't you put those AP on the switches? I assume those are PoE switches.

Toshi