[Solved]Wireless access to internal network

[CollabraIT]

We left setting up our wireless networks for after we had the pre-existing wired networks duplicated and working when we made the switch from Cisco to Fortinet. It seems now that this may have been a mistake.

We want 2 networks. One for guests, and one for corporate users. The one for guests is no problem. It's up and running. The one for corporate users isn't.

We'd like the corporate wifi to be on the same network as the internal wired network. The problem is that this was already setup as it's own dedicated interface. From what I've read, the usual solution is to make the wired and wireless part of the same virtual switch. This isn't an option for us due to the current setup.

How can I make the wireless bridge that internal network? Or maybe make that wireless network separate, but have access to the internal network as if it was a member?

[ede_pfau · Accepted solution]

Picking up on the first idea, if you create a policy from 'SSID' to 'internal', check the static NAT box. This way, the WiFi clients will appear as internal hosts, no matter which (different) subnet you've assigned to the WiFi.

Of course, there's a difference to true bridging: routing will not carry over broadcasts from one subnet to the other. That depends on your environment whether that is a requirement or not. Usually it isn't but there are corner cases.

[Nils]

I've created a SSID with option "Local Bridge" and then I've just connected the AP to the same switch/vlan as the Internal network.

Then you don't have to create a software switch.

[CollabraIT]

azh wrote:

Hello 

1) You can create policy from dedicated interface for wifi to Internal Lan Interface. 

OR 

2)  Create hardware switch then u will use same subnet for Lan and Wifi. 

ede_pfau wrote:

Picking up on the first idea, if you create a policy from 'SSID' to 'internal', check the static NAT box. This way, the WiFi clients will appear as internal hosts, no matter which (different) subnet you've assigned to the WiFi.

Of course, there's a difference to true bridging: routing will not carry over broadcasts from one subnet to the other. That depends on your environment whether that is a requirement or not. Usually it isn't but there are corner cases.

1 is what I was thinking might work, thanks I'll give it a try. 2 Can this work even though the interfaces for Lan and Wifi are already configured as separate ports?

Nilsan wrote:

I've created a SSID with option "Local Bridge" and then I've just connected the AP to the same switch/vlan as the Internal network.

Then you don't have to create a software switch.

I tried this, but since my vlans are not specified in the firewall it doesn't work. My vlans are controlled at the switches.

[CollabraIT]

It's working. Not ideally, but it is working. I set the wireless as a wireless tunnel instead of a bridge, and then set policy rules to allow access where I wanted. Maybe once I get the second FortiWifi unit for HA hotspare, I'll copy everything to it and then modify the interfaces for a software switch to try and get them on the same network. That way I can switch between them as separate entities for testing before I complete the HA config.