Fortinet Document Library

Version:


Table of Contents

6.2.0
Download PDF
Copy Link

UTM security profile groups on FortiAP-S

This guide provides instructions for simple configuration of security profile groups for FortiAP, including creating security profile groups and selecting profile groups for the SSID.

Note

This feature only works for local bridge SSIDs.

To configure UTM security profile groups on the FortiWiFi and FortiAP GUI:
  1. Create a security profile group:
    1. Go to WiFi & Switch Controller > Security Profile Groups, then click Create New.
    2. Enter the desired interface name. Configure logging as desired.
    3. Enable Antivirus, Web Filter, Application, IPS, or Botnet, then select the desired profile.
  2. Create a local bridge mode SSID and enable security profile groups:
    1. Go to WiFi & Switch Controller > SSID. Select SSID, then click Create New.
    2. Enter the desired interface name. For Traffic mode, select Bridge.
    3. In the SSID field, enter the desired SSID name. Configure security as desired.
    4. Enable Security Profile Group, then select the group created in step 1.
    5. Click OK.
  3. Select the SSID on a managed FortiAP by editing the FortiAP profile. The following configuration is based on a example using a managed FortiAP-320C and a "FAP320C-default" profile that is applied to the FortiAP-320C:
    1. Go to WiFi & Switch Controller > FortiAP Profile. Select the FAP320C-default profile, then click Edit.
    2. To broadcast the SSID from 2.4 G radio, scroll to Radio 1 > SSIDs. Select Manual, then click + to create the Fortinet-PSK SSID.
    3. To broadcast the SSID from 5 G radio, scroll to Radio 2 > SSIDs. Select Manual, then click + to create the Fortinet-PSK SSID.
    4. Click OK.
To configure UTM security profile groups using the FortiWiFi and FortiAP CLI:
  1. Create a security profile group:

    config wireless-controller utm-profile

    edit "wifi-UTM"

    set ips-sensor "default"

    set application-list "default"

    set antivirus-profile "default"

    set webfilter-profile "default"

    set scan-botnet-connections block

    next

    end

  2. Create a local bridge mode SSID and enable security profile groups:

    config wireless-controller vap

    edit "wifi-vap"

    set ssid "SSID-UTM"

    set passphrase 12345678

    set local-bridging enable

    set schedule "always"

    set utm-profile "wifi-UTM"

    next

    end

  3. Select the SSID on a managed FortiAP by editing the FortiAP profile. The following configuration is based on a example using a managed FortiAP-320C and a "FAP320C-default" profile that is applied to the FortiAP-320C:

    config wireless-controller wtp

    edit "FP320C3X14000640"

    set admin enable

    set wtp-profile "FAP320C-default"

    next

    end

    config wireless-controller wtp-profile

    edit "FAP320C-default"

    config radio-1

    set vap-all disable

    set vaps "wifi-vap"

    end

    config radio-2

    set vap-all disable

    set vaps "wifi-vap"

    end

    next

    end

UTM security profile groups on FortiAP-S

This guide provides instructions for simple configuration of security profile groups for FortiAP, including creating security profile groups and selecting profile groups for the SSID.

Note

This feature only works for local bridge SSIDs.

To configure UTM security profile groups on the FortiWiFi and FortiAP GUI:
  1. Create a security profile group:
    1. Go to WiFi & Switch Controller > Security Profile Groups, then click Create New.
    2. Enter the desired interface name. Configure logging as desired.
    3. Enable Antivirus, Web Filter, Application, IPS, or Botnet, then select the desired profile.
  2. Create a local bridge mode SSID and enable security profile groups:
    1. Go to WiFi & Switch Controller > SSID. Select SSID, then click Create New.
    2. Enter the desired interface name. For Traffic mode, select Bridge.
    3. In the SSID field, enter the desired SSID name. Configure security as desired.
    4. Enable Security Profile Group, then select the group created in step 1.
    5. Click OK.
  3. Select the SSID on a managed FortiAP by editing the FortiAP profile. The following configuration is based on a example using a managed FortiAP-320C and a "FAP320C-default" profile that is applied to the FortiAP-320C:
    1. Go to WiFi & Switch Controller > FortiAP Profile. Select the FAP320C-default profile, then click Edit.
    2. To broadcast the SSID from 2.4 G radio, scroll to Radio 1 > SSIDs. Select Manual, then click + to create the Fortinet-PSK SSID.
    3. To broadcast the SSID from 5 G radio, scroll to Radio 2 > SSIDs. Select Manual, then click + to create the Fortinet-PSK SSID.
    4. Click OK.
To configure UTM security profile groups using the FortiWiFi and FortiAP CLI:
  1. Create a security profile group:

    config wireless-controller utm-profile

    edit "wifi-UTM"

    set ips-sensor "default"

    set application-list "default"

    set antivirus-profile "default"

    set webfilter-profile "default"

    set scan-botnet-connections block

    next

    end

  2. Create a local bridge mode SSID and enable security profile groups:

    config wireless-controller vap

    edit "wifi-vap"

    set ssid "SSID-UTM"

    set passphrase 12345678

    set local-bridging enable

    set schedule "always"

    set utm-profile "wifi-UTM"

    next

    end

  3. Select the SSID on a managed FortiAP by editing the FortiAP profile. The following configuration is based on a example using a managed FortiAP-320C and a "FAP320C-default" profile that is applied to the FortiAP-320C:

    config wireless-controller wtp

    edit "FP320C3X14000640"

    set admin enable

    set wtp-profile "FAP320C-default"

    next

    end

    config wireless-controller wtp-profile

    edit "FAP320C-default"

    config radio-1

    set vap-all disable

    set vaps "wifi-vap"

    end

    config radio-2

    set vap-all disable

    set vaps "wifi-vap"

    end

    next

    end