Fortinet Document Library

Version:

Version:


Table of Contents

FortiWiFi and FortiAP Configuration Guide

Download PDF
Copy Link

Basic wireless network example

This example uses automatic configuration to set up a basic wireless network.

To configure this wireless network, perform the following tasks:

Configuring authentication for wireless users

You need to configure user accounts and add the users to a user group. This example shows only one account, but multiple accounts can be added as user group members.

To configure a WiFi user - GUI
  1. Go to User & Device > User Definition and select Create New.
  2. Select Local User and then click Next.
  3. Enter a User Name and Password and then click Next.
  4. Click Next.
  5. Make sure that Enable is selected and then click Create.
To configure the WiFi user group - GUI
  1. Go to User & Device > User Groups and select Create New.
  2. Enter the following information and then select OK:
  3. Name

    wlan_users

    Type

    Firewall

    Members

    Add users.

To configure a WiFi user and the WiFi user group - CLI

config user user

edit "user01"

set type password

set passwd "asdf12ghjk"

end

config user group

edit "wlan_users"

set member "user01"

end

Configuring the SSID

First, establish the SSID (network interface) for the network. This is independent of the number of physical access points that will be deployed. The network assigns IP addresses using DHCP.

To configure the SSID - GUI
  1. Go to WiFi & Switch Controller > SSID and select Create New > SSID.
  2. Enter the following information and select OK:
  3. Interface Name

    example_wifi_if

    Traffic Mode

    Tunnel to Wireless Controller

    IP/Network Mask

    10.10.110.1/24

    Administrative Access

    Ping (to assist with testing)

    DHCP Server

    Enable

     

    Address Range

    10.10.110.2 - 10.10.110.199

    Netmask

    255.255.255.0

    Default Gateway

    Same As Interface IP

    DNS Server

    Same as System DNS

    SSID

    example_wifi

    Security Mode

    WPA2 Enterprise

    Authentication

    Local, select wlan_users user group.

    Leave other settings at their default values.

To configure the SSID - CLI

config wireless-controller vap

edit example_wifi_if

set ssid "example_wifi"

set broadcast-ssid enable

set security wpa-enterprise

set auth usergroup

set usergroup wlan_users

set schedule always

end

config system interface

edit example_wifi_if

set ip 10.10.110.1 255.255.255.0

end

config system dhcp server

edit 0

set default-gateway 10.10.110.1

set dns-service default

set interface "example_wifi_if"

config ip-range

edit 1

set end-ip 10.10.110.199

set start-ip 10.10.110.2

end

set netmask 255.255.255.0

end

Adding the SSID to the FortiAP Profile

The radio portion of the FortiAP configuration is contained in the FortiAP Profile. By default, there is a profile for each platform (FortiAP model). You can create additional profiles if needed. The SSID needs to be specified in the profile.

To add the SSID to the FortiAP Profile - GUI
  1. Go to WiFi & Switch Controller > FortiAP Profiles and edit the profile for your model of FortiAP unit.
  2. In Radio 1 and Radio 2, add example_wifi in SSID.
  3. Select OK.

Configuring security policies

A security policy is needed to enable WiFi users to access the Internet on port1. First you create firewall address for the WiFi network, then you create the example_wifi to port1 policy.

To create a firewall address for WiFi users - GUI
  1. Go to Policy & Objects > Addresses.
  2. Select Create New > Address, enter the following information and select OK.
  3. Name

    wlan_user_net

    Type

    IP/Netmask

    Subnet / IP Range

    10.10.110.0/24

    Interface

    example_wifi_if

    Show in Address List

    Enabled

To create a firewall address for WiFi users - CLI

config firewall address

edit "wlan_user_net"

set associated-interface "example_wifi_if"

set subnet 10.10.110.0 255.255.255.0

end

To create a security policy for WiFi users - GUI
  1. Go to Policy & Objects > IPv4 Policyand select Create New.
  2. Enter the following information and select OK:
  3. Incoming Interface

    example_wifi_if

    Source Address

    wlan_user_net

    Outgoing Interface

    port1

    Destination Address

    All

    Schedule

    always

    Service

    ALL

    Action

    ACCEPT

    NAT

    ON. Select Use Destination Interface Address (default).

    Leave other settings at their default values.

To create a firewall policy for WiFi users - CLI

config firewall policy

edit 0

set srcintf "example_wifi"

set dstintf "port1"

set srcaddr "wlan_user_net"

set dstaddr "all"

set schedule always

set service ALL

set action accept

set nat enable

end

Connecting the FortiAP units

You need to connect each FortiAP unit to the FortiGate unit, wait for it to be recognized, and then assign it to the AP Profile. But first, you must configure the interface to which the FortiAP units connect and the DHCP server that assigns their IP addresses.

In this example, the FortiAP units connect to port3 and are controlled through IP addresses on the 10.10.70.0/24 network.

To configure the interface for the AP unit - GUI
  1. Go to Network > Interfaces, and edit the interface to which the AP unit connects (in this example, port3).
  2. In Addressing mode, select Manual.
  3. In IP/Network Mask, enter an IP address and netmask for the interface (in this example, 10.10.70.1/255.255.255.0).

  4. In the Administrative Access section, go to IPv4 and select the CAPWAP checkbox.
  5. When FortiAP units are connected to the interface on FortiGate (directly or through a switch), you can go to the Edit Interface section and set the Role to LAN.

    Selecting the LAN role loads the DHCP Server toggle. If you enable DHCP Server, the GUI can automatically set the DHCP IP range based on the interface IP address.

  6. Click OK.
To configure the interface for the AP unit - CLI

config system interface

edit "port3"

set mode static

set ip 10.10.70.1 255.255.255.0

set allowaccess capwap

next

end

To configure the DHCP server for AP units - CLI

config system dhcp server

edit 3

set interface "port3"

config exclude-range

edit 1

set start-ip 10.10.70.1

set end-ip 10.10.70.1

next

end

config ip-range

edit 1

set start-ip 10.10.70.2

set end-ip 10.10.70.254

next

end

set default-gateway 10.10.70.1

set netmask 255.255.255.0

set vci-match enable

set vci-string "FortiAP"

next

end

To connect a FortiAP unit - GUI
  1. Go to WiFi & Switch Controller > Managed FortiAPs.
  2. Connect the FortiAP unit to port 3.
  3. Periodically select Refresh while waiting for the FortiAP unit to be listed.
    Recognition of the FortiAP unit can take up to two minutes.
    If FortiAP units are connected but cannot be recognized, try disabling VCI-Match in the DHCP server settings.
  4. When the FortiAP unit is listed, select the entry to edit it.
    The Edit Managed Access Point window opens.
  5. In State, select Authorize.
  6. In FortiAP Profile, select the default profile for the FortiAP model.
  7. Select OK.
  8. Repeat Steps 2 through 7 for each FortiAP unit.
To connect a FortiAP unit - CLI
  1. Connect the FortiAP unit to port 3.
  2. Enter

    config wireless-controller wtp

  3. Wait 30 seconds, then enter get.
  4. Retry the get command every 15 seconds or so until the unit is listed, like this:

    == [ FAP22B3U10600118 ]

    wtp-id: FAP22B3U10600118

  5. Edit the discovered FortiAP unit like this:

    edit FAP22B3U10600118

    set admin enable

    end

  6. Repeat Steps 2 through 5 for each FortiAP unit.

Basic wireless network example

This example uses automatic configuration to set up a basic wireless network.

To configure this wireless network, perform the following tasks:

Configuring authentication for wireless users

You need to configure user accounts and add the users to a user group. This example shows only one account, but multiple accounts can be added as user group members.

To configure a WiFi user - GUI
  1. Go to User & Device > User Definition and select Create New.
  2. Select Local User and then click Next.
  3. Enter a User Name and Password and then click Next.
  4. Click Next.
  5. Make sure that Enable is selected and then click Create.
To configure the WiFi user group - GUI
  1. Go to User & Device > User Groups and select Create New.
  2. Enter the following information and then select OK:
  3. Name

    wlan_users

    Type

    Firewall

    Members

    Add users.

To configure a WiFi user and the WiFi user group - CLI

config user user

edit "user01"

set type password

set passwd "asdf12ghjk"

end

config user group

edit "wlan_users"

set member "user01"

end

Configuring the SSID

First, establish the SSID (network interface) for the network. This is independent of the number of physical access points that will be deployed. The network assigns IP addresses using DHCP.

To configure the SSID - GUI
  1. Go to WiFi & Switch Controller > SSID and select Create New > SSID.
  2. Enter the following information and select OK:
  3. Interface Name

    example_wifi_if

    Traffic Mode

    Tunnel to Wireless Controller

    IP/Network Mask

    10.10.110.1/24

    Administrative Access

    Ping (to assist with testing)

    DHCP Server

    Enable

     

    Address Range

    10.10.110.2 - 10.10.110.199

    Netmask

    255.255.255.0

    Default Gateway

    Same As Interface IP

    DNS Server

    Same as System DNS

    SSID

    example_wifi

    Security Mode

    WPA2 Enterprise

    Authentication

    Local, select wlan_users user group.

    Leave other settings at their default values.

To configure the SSID - CLI

config wireless-controller vap

edit example_wifi_if

set ssid "example_wifi"

set broadcast-ssid enable

set security wpa-enterprise

set auth usergroup

set usergroup wlan_users

set schedule always

end

config system interface

edit example_wifi_if

set ip 10.10.110.1 255.255.255.0

end

config system dhcp server

edit 0

set default-gateway 10.10.110.1

set dns-service default

set interface "example_wifi_if"

config ip-range

edit 1

set end-ip 10.10.110.199

set start-ip 10.10.110.2

end

set netmask 255.255.255.0

end

Adding the SSID to the FortiAP Profile

The radio portion of the FortiAP configuration is contained in the FortiAP Profile. By default, there is a profile for each platform (FortiAP model). You can create additional profiles if needed. The SSID needs to be specified in the profile.

To add the SSID to the FortiAP Profile - GUI
  1. Go to WiFi & Switch Controller > FortiAP Profiles and edit the profile for your model of FortiAP unit.
  2. In Radio 1 and Radio 2, add example_wifi in SSID.
  3. Select OK.

Configuring security policies

A security policy is needed to enable WiFi users to access the Internet on port1. First you create firewall address for the WiFi network, then you create the example_wifi to port1 policy.

To create a firewall address for WiFi users - GUI
  1. Go to Policy & Objects > Addresses.
  2. Select Create New > Address, enter the following information and select OK.
  3. Name

    wlan_user_net

    Type

    IP/Netmask

    Subnet / IP Range

    10.10.110.0/24

    Interface

    example_wifi_if

    Show in Address List

    Enabled

To create a firewall address for WiFi users - CLI

config firewall address

edit "wlan_user_net"

set associated-interface "example_wifi_if"

set subnet 10.10.110.0 255.255.255.0

end

To create a security policy for WiFi users - GUI
  1. Go to Policy & Objects > IPv4 Policyand select Create New.
  2. Enter the following information and select OK:
  3. Incoming Interface

    example_wifi_if

    Source Address

    wlan_user_net

    Outgoing Interface

    port1

    Destination Address

    All

    Schedule

    always

    Service

    ALL

    Action

    ACCEPT

    NAT

    ON. Select Use Destination Interface Address (default).

    Leave other settings at their default values.

To create a firewall policy for WiFi users - CLI

config firewall policy

edit 0

set srcintf "example_wifi"

set dstintf "port1"

set srcaddr "wlan_user_net"

set dstaddr "all"

set schedule always

set service ALL

set action accept

set nat enable

end

Connecting the FortiAP units

You need to connect each FortiAP unit to the FortiGate unit, wait for it to be recognized, and then assign it to the AP Profile. But first, you must configure the interface to which the FortiAP units connect and the DHCP server that assigns their IP addresses.

In this example, the FortiAP units connect to port3 and are controlled through IP addresses on the 10.10.70.0/24 network.

To configure the interface for the AP unit - GUI
  1. Go to Network > Interfaces, and edit the interface to which the AP unit connects (in this example, port3).
  2. In Addressing mode, select Manual.
  3. In IP/Network Mask, enter an IP address and netmask for the interface (in this example, 10.10.70.1/255.255.255.0).

  4. In the Administrative Access section, go to IPv4 and select the CAPWAP checkbox.
  5. When FortiAP units are connected to the interface on FortiGate (directly or through a switch), you can go to the Edit Interface section and set the Role to LAN.

    Selecting the LAN role loads the DHCP Server toggle. If you enable DHCP Server, the GUI can automatically set the DHCP IP range based on the interface IP address.

  6. Click OK.
To configure the interface for the AP unit - CLI

config system interface

edit "port3"

set mode static

set ip 10.10.70.1 255.255.255.0

set allowaccess capwap

next

end

To configure the DHCP server for AP units - CLI

config system dhcp server

edit 3

set interface "port3"

config exclude-range

edit 1

set start-ip 10.10.70.1

set end-ip 10.10.70.1

next

end

config ip-range

edit 1

set start-ip 10.10.70.2

set end-ip 10.10.70.254

next

end

set default-gateway 10.10.70.1

set netmask 255.255.255.0

set vci-match enable

set vci-string "FortiAP"

next

end

To connect a FortiAP unit - GUI
  1. Go to WiFi & Switch Controller > Managed FortiAPs.
  2. Connect the FortiAP unit to port 3.
  3. Periodically select Refresh while waiting for the FortiAP unit to be listed.
    Recognition of the FortiAP unit can take up to two minutes.
    If FortiAP units are connected but cannot be recognized, try disabling VCI-Match in the DHCP server settings.
  4. When the FortiAP unit is listed, select the entry to edit it.
    The Edit Managed Access Point window opens.
  5. In State, select Authorize.
  6. In FortiAP Profile, select the default profile for the FortiAP model.
  7. Select OK.
  8. Repeat Steps 2 through 7 for each FortiAP unit.
To connect a FortiAP unit - CLI
  1. Connect the FortiAP unit to port 3.
  2. Enter

    config wireless-controller wtp

  3. Wait 30 seconds, then enter get.
  4. Retry the get command every 15 seconds or so until the unit is listed, like this:

    == [ FAP22B3U10600118 ]

    wtp-id: FAP22B3U10600118

  5. Edit the discovered FortiAP unit like this:

    edit FAP22B3U10600118

    set admin enable

    end

  6. Repeat Steps 2 through 5 for each FortiAP unit.