Wifi-Bridge with FortiWifi as controller in combination with different SSIDs and VLANs

[Timh]

Hello,

What I have:

• FortiWifi 40F as Wifi-Controller with
  • different VLANs (internal ID40, voip ID70, mgm ID50, IoT ID100 , guest ID200)
  • different SSIDs (internal, guests, IoT)
  • "internal" SSID is bridged to LAN internal
  • "voip" is only LAN
  • SSIDs "guest" and "IoT" are tunneled with separate Subnets/VLANIDs

What I want: 

Connect small work container to LAN

Idea: FortiAP as LAN-Bridge and Wifi-MESH-AP

• On FortiAP-site managed Switch (not Forti)
  • with VLAN 40, 50 and 70
  • Switch connected via LAN to ForitAP
• ForitAP extends SSIDs "guests" and "IoT" (Mesh)
• Bridged Wifi-connection between FortiWifi and FortiAP (Trunk)
  • tunneling VLANs 40, 50 and 70 for LAN
  • tunneling VLANs 100 and 200 for Wifi
• Routing and Ffirewall on FortiWifi

Technical consulted says it doesn't work with FW+AP and I need a Layer2-WifiBridge or a second FW.

Both solution have disadvantages:

• Wifi-Bridge: no extending of existing Wifi
• second FW: no mesh and more configuration

I cannot/ don't want believe the consultant that Forti cannot do this. I would be very happy and thankful if someone has an idea how to get this working.

PS: It is really a smal office. So I don't have any issues with bandwidth.

Best regards

Tim

[jhussain_FTNT]

Hi,

According to your update, I understand you want to build up a mesh connection between two FortiAPs; please confirm.

If so, please refer to the document below.

https://docs.fortinet.com/document/fortiap/6.4.0/fortiwifi-and-fortiap-cookbook/638238/setting-up-a-...

Regards

Jamal Hussain

[Timh]

Hi, 

thank you for your reply. 

It should be a mesh connection between FortiWifi and FortiAP. And a network bridge for some LAN-Subnets tagged by VLAN.

I know this document, but there is nothing written if it is possible to bridge different Subnets with different VLANs to the NIC of the Leaf-AP. 

Best regards

Tim

edit: changed picture and add guest-wifi

[Bjay_Prakash_Ghising]

Hi @Timh 

I couldn't understand your requirements fully. Could you please provide more details or clarification?

In the meantime, if you're looking to establish a point-to-point wireless mesh network, you can follow the guidance provided in the attached link. This should help you proceed with your networking objectives effectively.

https://docs.fortinet.com/document/fortiap/7.4.2/fortiwifi-and-fortiap-configuration-guide/196651/wi...

https://docs.fortinet.com/document/fortiap/7.4.2/fortiwifi-and-fortiap-configuration-guide/937763/co...

let us know if you need further assistance. 

Kind Regards, 

Bijay Prakash Ghising

[Timh]

Hi Bijay,

that is what I whant. But can you confirm that:

• wifi access to "guest" and "internal" on both devices (fortiwifi and fortiap)
• tagged vlan (4,70) on the fortiap lan interface

ist possible then.

best regards,

Tim

[jiahoong112]

you can make fortiwifi the wifi client and connect to the fortiap using a bridge ssid: https://docs.fortinet.com/document/fortigate/5.6.0/cookbook/756937/setting-up-a-wifi-bridge-with-a-f... 

fortiwifi as a wifi client: https://docs.fortinet.com/document/fortiap/7.4.2/fortiwifi-and-fortiap-configuration-guide/404373/co... 

from my understanding, you seem to be building a wireless bridge between fortiap and fortiwifi to bridge vlans together. Mesh would not be necessary in this case as there is already a wireless bridge. 

[Timh]

from your post I understand:

• FortiAP as Controller
• FortiWifi as Client
• Connect them via bridge-wifi
• Add the SSIDs internal and guest to both wifi-profiles

Can you confirm, that it is possible then:

• wifi access to "guest" and "internal" on both devices (fortiwifi and fortiap)
• tagged vlan (4,70) on the fortiap lan interface