Extend dynamic VLANs SSID on a remote site with a FortiAP 14C

[mike_dp]

Hello,

I'm trying to extend my office private SSID which is using dynamic VLANs (2 sub interfaces under the SSID interface) to assign different policies to different groups (the authentication is made from Active Directory Radius) to a remote site (home, hotels, etc.) with a FortiAP 14C. I have a Fortigate 300D on OS 5.4 acting as the WIFI controller and the WAN interface accepts CAPWAP traffic and my FortiAP has my Fortigate WAN IP in it's setting for the remote controller. So my FortiAP connects to the Fortigate by CAPWAP tunneling over the Internet. I see the FortiAP 14C in my FortiAP devices in my Fortigate and I've authorized it and the FortiAP is broadcasting the SSID like it should but I can't connect to it. I always get an APIPA IP and it's the same thing for the LAN ports of the FortiAP because the lan ports are like the SSID. I've also done a packet trace on the WIFI main interface and seems like the traffic goes to that interface instead of the sub-interfaces.

However if I try to extend my public WIFI SSID which doesn't use the dynamic VLAN and use a regular WIFI interface only, it works like a charm. I get my IP address and from remote it's like I'm sitting at the office using the public WIFI.

Does anyone ever tried to accomplish something like this ? Maybe it's not possible to do this kind of setup with dynamic VLANs and I should just create a new interface dedicated to remote WIFI users.

Thank you,

[Bromont_FTNT]

Not sure bridging LAN will work as you expect with dynamic vlan. That said, wireless connections should work. Is the 14C using DTLS across the internet? Does it work ok with other APs or is it just an issue with the 14C?

[mike_dp]

It works for my other SSID which doesn't use dynamic VLANs and uses a captive portal as authentication. I'm trying with clear text and not DTLS for testing purposes. I've only tried with one 14C since it works with my other SSID.

I think it doesn't work with dynamic VLAN or maybe there's something wrong with my authentication.

Thank you,

[wanglei_FTNT]

Please check that VLANs/DHCP servers are configured properly on your remote site since client will need to get IPs from the local DHCP server. 

On FAP ( You can enable telnet from FGT under wtp-profile, set allow access ...), use sta command to see whether client is assigned to the right VLAN

[mike_dp]

I think VLANs/DHCP are configured properly because the private SSID works fine at our office and users are separated in 2 subnets like they should with dynamic VLANs. DHCP is at the Fortigate SSID sub-interfaces.

I don't really get the 2nd part of your post since I'm fairly new to Fortigates and FortiAPs. What do you mean by sta command ? Something like : diagnose wireless-controller wlac -d sta ? And why would I need to do telnet to debug ?

TAC support suggested to try  :

diagnose debug application fnbamd -1

diagnose debug enable

I've tried it but got nothing in return.

[wanglei_FTNT]

Hi 

1) for SSID pushed to remote AP, traffic is forwarded locally. By, "DHCP is at the Fortigate SSID sub-interfaces.", you might mean you created VLAN interface/DHCP servers under a particular interface or soft switch. You should not be allowed to create DHCP server on a local bridged SSID. Since DHCP works for your other clients, you can check whether switch path from your FAP14C all the way to FGT has proper VLAN configured/allowed. 

2) you don't need to telnet to FAP to debug. This is just a quick way to check that client is assigned to proper VLAN

[Bromont_FTNT]

1) Are you using dynamic vlan in tunnel mode SSID?

2) try this on the Fortigate: diag wireless-controller wlac -c sta

Is the vlan entry correct?

[mike_dp]

When I try with the public SSID (the one that's working fine from remote) with FortiAP 14C lan port (lan ports are bridged to the public SSID) I get :

STA mac : b8:88:e3:ea:de:dd authed : yes lan_authed cp_authed wtp : 1-PUBLIC IP:35246 rId : 1 aId : 65535 wId : 0 bssid : 08:5b:0e:ad:95:31 cap : 0000 VLAN tag : 0000 (0)

And If trying with the private SSID with dynamic VLANs it doesn't connect the my FortiAP 14C but one of the 221C here at the office (the regular office WIFI) I get : 

STA mac : 60:36:dd:cd:8e:3a authed : yes wtp : 1-INTERNAL AP IP ADDRESS:5246 rId : 0 aId : 1 wId : 0 bssid : 90:6c:ac:1f:85:7b cap : 0431 VLAN tag : 00c9 (201)

MAC addresses are different because test 1 is with the LAN port and test 2 is by WIFI.

It proves my dynamic VLAN works like it should with the VLAN tag.

When I try with the LAN ports binded to the private SSID (dynamic

VLANs) I get no IP address from the sub interface DHCP server of the Fortigate therefore I get nothing in the : diag wireless-controller wlac -c sta.

I've applied : set dynamic-vlan enable 

on the SSID wireless-controller vap interface. Is there something else to do to make dynamic VLANs work when trying to extend the SSID to a remote AP (FortiAP14C) ?

The only difference between my public and private WIFI is the radius authentication and the dynamic VLANs.

Maybe it doesn't work to extend an SSID with dynamic VLAN for some reason ?

[yzhang_FTNT]

Dynamic VLAN feature is not supported for host behind the LAN port at this time.  Dynamic VLAN is implemented as part of client authentication feature, and for hosts connected though the LAN port, they are treated as authenticated all the times, and do not go through the authentication procedure as wireless clients.

[mike_dp]

It makes more sense now. I've tried the remote FortiAP actually from a remote site yesterday evening instead of from another network at the office and I can actually connect to the private WIFI but get APIPA on LAN ports.

Will LAN ports be suported in the near future ?