Third party Wireless access point

[springeruk]

Hi all,

I had intended to use a low cost Netgear Wireless Access Point connected via ethernet back to my Fortiwifi60D to extend the wireless network but have and have just been told that I can only use a Fortigate product to do this. That seems almost impossible to believe as I have never had this restriction with any other firewall/router manufacturer.

Before I consider buying a significantly more expensive Fortigate device... Has anyone here ever used a third party wireless access point with a Fortiwifi60D (or any other Fortigate firewall/router)?

Thanks.

[tanr]

If the Netgear WAP is connected via ethernet I would think you should be able to use it for wifi access -- I'm planning on doing something similar by the end of the week.

Caveats I've found in the docs and the forum:

- FGT CAPWAP management of a third party WAP won't work - it's FGT specific

- Tunnel to FGT from WAP, like FortiAPs, isn't possible

- If Netgear WAP uses same SSID as 60D, you won't get automatic handoffs between APs, etc., plus you may have to explicitly tell the 60D that your Netgear WAP isn't a rogue AP

So if you don't need the management through the FGT, or the tunnel, and if you are either using a different SSID or have the WAP far enough away from the FortiWifi I would think things would be fine.

Anyone who's actually set this up want to comment?

[springeruk]

Thanks for your reply tanr. Yes, you'd think is would be ok wouldn't you?! And no, I don't want to manage it from the Fortinet device. However and hour on Friday and three hours today on the phone with Fortinet support (not to mention the hours of waiting around for a call!), seems to suggest otherwise.

I've brought the Netgear WAP home, plugged it into an ethernet port on my home router and with no changes* whatsoever to the configuration it works immediately.

*In fact it still has the office IP address set which is different to my home network! But that's no surprise the IP is just for management.

The SSID is different to the one the Fortiwifi60D is putting out, they're far enough apart (we needed it for this deadzone coverage), but I'm still finding it hard to believe this should not work, it's as if Fortinet have deliberately locked out third party devices.

Tell me more about the Rouge AP config, I wonder if I should be looking at that?

Thanks.

[Bromont_FTNT]

A third party AP should work just fine behind any Fortigate.... it's just another network device and not something support will be able to help with unless there's an issue with the FGT itself

[tanr]

@springeruk

I'm hoping the home router you're referring to is behind the FGT?

So you've got the WAP hooked up and working, meaning you can connect to whatever SSID it's broadcasting?

I think you need to be more specific when you say it's not working.  

For example:

1. Can you connect a laptop to the Netgear wifi and see a connection?

2. Assuming your laptop gets its IP through DHCP, is it showing an IP in the WAP's subnet?

3. With that laptop, can you ping the IP of the WAP?

4. With that laptop can you ping the IP of the FGT?  Of an external website?

I'm guessing that 1 is a "yes", and "4" is a no?

If so, you probably just need to change the IP of your WAP to be within the subnet of whatever FGT interface you've connected it to.  Also, the WAP shouldn't be serving out DHCP IPs, it should just let the FGT interface its on give out the IPs.

If you want to keep the WAP with a different IP/subnet, then you'll need to add security policies (and possibly routing) to the FGT

[Bromont_FTNT]

Upload your config to the ticket. I don't see why it wouldn't work from your description.

[springeruk]

Bromont wrote:

Upload your config to the ticket. I don't see why it wouldn't work from your description.

Hi Bromont

yes, we all agree it 'should' work, you're preaching to the converted there ;)  but it doesn't!

I'm not entirely comfortable with uploading my config here as I'm not certain what (potentially sensitive) information I'll be publicly divulging. When you say 'ticket' are you referring to here or the support ticket, ie, do you work for FGT?

[springeruk]

Thanks tanr for your input again. To avoid confusion I've answered your points within the text of your response preceeded with a dash '-'.

A

tanr wrote:

@springeruk

I'm hoping the home router you're referring to is behind the FGT?

- No, I actually brought it to my home, the FGT is at the office. Sorry if I wasn't clear about that.

So you've got the WAP hooked up and working, meaning you can connect to whatever SSID it's broadcasting?

- Yes, although again for this test it's in my home. So I can connect to my home wifi or the WAP wifi. DHCP is on my home router.

I think you need to be more specific when you say it's not working.  

For example:

1. Can you connect a laptop to the Netgear wifi and see a connection?

- Yes

2. Assuming your laptop gets its IP through DHCP, is it showing an IP in the WAP's subnet?

- The WAP is on the same subnet as the network, it's just an extension of the network connected via ethernet.

- Interestingly it takes 60-70 seconds for devices to be allocated an IP address when connecting via the WAP on the FGT network, whereas it takes just a few seconds (as one would expect) when connected via the WAP on my home network (Connecting a computer to the FGT wifi or any ethernet connection on the FGT network in the office again takes just a few seconds).

3. With that laptop, can you ping the IP of the WAP?

- Yes.In fact I can ping any device connected to the network switch on the network but not the FGT (which is connected to the switch) or any devices that are directly connected to LAN ports on the FGT.

4. With that laptop can you ping the IP of the FGT?  Of an external website?

- No and No. 

I'm guessing that 1 is a "yes", and "4" is a no?

If so, you probably just need to change the IP of your WAP to be within the subnet of whatever FGT interface you've connected it to.  Also, the WAP shouldn't be serving out DHCP IPs, it should just let the FGT interface its on give out the IPs.

- The WAP is on the same subnet

- The WAP isn't (cannot) serving DHCP,  our Win Server serves DHCP and DNS

- Working with FGT yesterday we tried disabling DHCP at the sever and enabling it on the FGT, that didn't help.

If you want to keep the WAP with a different IP/subnet, then you'll need to add security policies (and possibly routing) to the FGT 

[michaelbazy_FTNT]

From your answers, it looks a lot like a L2 issue. If you unplug the RJ45 port of the AP, and connect a laptop on it, can you receive an IP address? and ping the FGT?

[springeruk]

michaelbazy wrote:

From your answers, it looks a lot like a L2 issue. If you unplug the RJ45 port of the AP, and connect a laptop on it, can you receive an IP address? and ping the FGT?

Hi Mike

- Yes to both those questions.