Question on configuring a Guest SSID to use a dedicated WAN port

[duffmcgruff]

I have a configuration question. Currently we have about 10 AP’s connected to a 100F, acting as a wireless controller only. Currently it has one connection to the network, on one port. That port serves as the only port for SSID, MGMT, and Gateway traffic. It works fine currently. It basically dumps all the traffic back out to the core router and then out to the internet.

What I want to do is utilize another outside modem to route guest traffic through. Getting the load of that SSID off our network completely. This was setup prior to my arrival and I am not super skilled in Fortinet configs (first unit). Through some limited testing, I created a WAN port and plugged the outside modem into it. Created the SSID and then a Firewall policy to route the traffic over to the WAN port I selected. It works like a charm (for a little). My existing SSID’s and remote AP’s eventually route out via the new WAN I created, despite having Static Routes and Software switches setup to direct the traffic.

My questions is: What would be the best way to set this 100 F up to accomplish the task with the following information?

1: All AP’s are entering the 100F via the local LAN.

2: All Ap’s are using subnets that need to be routed back to the core router to get outside.

3: Existing SSID’s are tunneled and need to route back to the core router.

4: The connected outside modem only needs to be utilized by the new Guest SSID.

5: The Guest SSID will have a DHCP server and provide an IP range not able to route via the core router

Thanks for the help, I appreciate it. If I need to create some new ports and break this stuff out, we can. I’ve partly been successful with some limited testing, but I have a feeling I am missing something obvious. With my limited knowledge of Fortinet firewalls, I am looking for whatever assistance I can get. Thanks!

[adambomb1219]

You could use SD-WAN to steer the guest traffic out of the new WAN interface.  Or Policy Based routing.

[duffmcgruff]

I do not have SD-WAN as an option currently. I did create a firewall policy to route the traffic initially. However, I was having some routing issues with some of the existing WIFI SSID's trying to go out the same port as the Guest. I have a feeling that my issue exisits in the policy/distance weighting, but im not familiar with that enough to know where I need to attack. Thanks!

[adambomb1219]

Why can't you use SD-WAN?  If you can't then Policy Based Routing is what you need. 

[duffmcgruff]

It does not offer that as an option when I log into the GUI. I dont know if that is a licenseing issue or what, but I do not have that as an option. I am picking up this from a previous tech and trying to figure it out, so I might be missing something. I am taking a look at the policy options. 

[adambomb1219]

System -> Feature Visibility

[duffmcgruff]

Perfect! I can see that now. I will give that a shot and see how it goes. 

[Rajan_kohli]

Hi @duffmcgruff,

You can follow this kb article to make a policy route: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-the-firewall-Policy-Routes/ta-...

Regards,

Rajan