Cant get a new WiFi SSID on LAN subnet on Fortigate 200E

[InfraSec0]

Hi, am hoping someone can help as stuck with a WiFi SSID being accessed over the LAN.

I have just took over an IT environment which is all Fortigate Firewalls & AP's so have been getting familiar with the kit but having issues with something I would say should be quite simple!

Background is a pair of Fortigate 200E in HA with physically configured interfaces, Port 1 on the FG's is for the LAN, currently the WiFi controller is configured on Port 3 and all the AP's talk to that port only, there is DHCP on Port 3 giving IP's to the AP's and there is currently 1 x SSID for guest access which is set up as a Tunnel again with its own subnet and DHCP scope and firewall rules to allow that out etc.

What I am trying to do is get a new SSID created for a corporate WiFi connected to the LAN, I have tried all sorts of things inc making the new corporate SSID set in Bridge mode, I seen while researching that a software switch may be needed so tried that but Port 1 (LAN) isn't available to add in with the WiFi SSID.

Really not sure where to go from here if anyone can help as its getting quite frustrating now? :(

Many Thanks!

[Dan_Eng52]

Hi InfraSec0, 

I am assuming that you have a switch connected to your 200E HA cluster FortiGates? If you had both Port1 and Port3 connected to VLAN's on the switch on the AP ports you will be able to set the "native-vlan" to that of Port3 which will allow AP's to receive DHCP/Management connectivity and then simply in the "allowed-vlans" to that of Port1 which will allow you to bridge to that VLAN and have the connectivity you desire. 

In tunnel mode, the SSID will create a sperate network therefore, devices on the wireless network cannot directly communicate with devices on the wired network without going through the firewall. In the design mentioned above this wouldn't be tunnelled to the FortiGate but rather bridged to the required VLAN meaning the switch can handle intra-vlan traffic.

Hope that makes sense. 

Regards, 

Dan.

[WChambers]

Create the new Corporate SSID as a tunnel, and then create policies that allow the tunneled SSID to access the LAN. Enable NAT or a NAT pool on the policy if you need the Corporate SSID traffic to talk on the same subnet as the LAN. If not needed, then disable NAT.

This would be the quickest/easiest way to get connectivity in my mind if you have only physical interfaces set up on the FortiGate, and there are no VLANs and/or switching in-between. 

[Dan_Eng52]

I would say it is easier to create software switch interface with the internal LAN interface and WiFi network virtual interfaces as members this way the DHCP, policies etc are the same as both wired and wireless client are on the same subnet. This means he must delete all configuration objects that use this interface but is a more convenient configuration if wanted this way. But either way it will work that's for sure :D 

[Dan_Eng52]

If you wanted to create a software switch, you need to make sure the interface has 'no reference' associated otherwise you will be unable to add it in. 

[InfraSec0]

Many thanks for the replies Dan_Eng52 & WChambers

As this HA Firewall set up is in a live environment and the LAN interface has a tonne of references then deleting them to create a software switch I dont think would be an option as from what I gather the Firewalls have been configured as interface only out the box so too late to go back and re-do.

From the 200E's there are network switches connected so what you are saying is interesting and looks worth a go, so Port 1 for LAN is the native VLAN on the switches and Port 3 for WiFi network is a VLAN on the swicthes but set to native/untagged for the ports connected to the AP's.   Are you saying on the ports the AP's are connected to I could add the LAN VLAN as tagged and then use bridge mode and see if that works?

Will look into your suggestion as well WChambers using NAT as when I looked at making the corporate SSID as a tunnel it wants you to specifiy a new subnet etc which I didnt want to do as want it to use the LAN interface/DHCP etc

[Dan_Eng52]

Hi InfraSec0, 

Yes for sure, whichever VLAN is configured for Port3 on your FortiGates set this as the native-vlan on your AP ports so that they can receive DHCP and connect for management purposes and then on the allowed-vlans simply add the VLAN for you LAN and bridge the SSID to that VLAN. 

Regards, 

Dan.