Enter a name for the SSID interface.

WiFi SSID.

Tunnel — (Tunnel to Wireless Controller) Data for WLAN passes through WiFi Controller. This is the default.

Bridge — (Local bridge with FortiAP Interface) FortiAP unit Ethernet and WiFi interfaces are bridged.

Mesh — (Mesh Downlink) Radio receives data for WLAN from mesh backhaul SSID.

Enter the IP address and netmask for the SSID.

Enter the IPv6 address. This is available only when IPv6 has been enabled on the unit.

Select which types of administrative access are permitted on this SSID.

If you have IPv6 addresses, select the permitted IPv6 administrative access types for this SSID.

To assign IP addresses to clients, enable DHCP server. You can define IP address ranges for a DHCP server on the FortiGate unit or relay DHCP requests to an external server.

If the unit is in transparent mode, the DHCP server settings will be unavailable.

For more information, see Configuring DHCP for WiFi clients.

Detect connected device type. Enabled by default.

Enabled by default.

WiFi Settings

Enter the SSID. By default, this field contains fortinet.

Select the security mode for the wireless interface. Wireless users must use the same security mode to be able to connect to this wireless interface. Additional security mode options are available in the CLI. For more information, see Configuring security.

Captive Portal – authenticates users through a customizable web page.

WPA2-Personal – WPA2 is WiFi Protected Access version 2. There is one pre-shared key (password) that all users use.

WPA2-Personal with Captive Portal – The user will need to know the pre-shared key and will also be authenticated through the custom portal.

WPA2-Enterprise – similar to WPA2-Personal, but is best used for enterprise networks. Each user is separately authenticated by user name and password.

Other choices are: WPA3-Enterprise, WPA3-SAE, WPA3-SAE-Transition, OWE, and OSEN.

Available only when Security Mode is WPA2-Personal. Enter the encryption key that the clients must use.

Available only when Security Mode is WPA2-Enterprise.

Select one of the following:

RADIUS Server — Select the RADIUS server that will authenticate the clients.
Local – Select the user group(s) that can authenticate.

Available only when Security Mode is Captive Portal. Choose the captive portal type. Authentication is available with or without a usage policy disclaimer notice.

Local - portal hosted on the FortiGate unit
External - enter FQDN or IP address of external portal

Select permitted user groups for captive portal authentication.

Select exempt lists whose members will not be subject to captive portal authentication.

Click the listed portal pages to edit them.

Optionally, select Specific URL and enter a URL for user redirection after captive portal authentication. By default, users are redirected to the URL that they originally requested.

This option is available for local bridge SSIDs with WPA-Personal security. See Continued FortiAP operation when WiFi controller connection is down.

Optionally, disable broadcast of SSID. By default, the SSID is broadcast.

Select when the SSID is enabled. You can choose any schedule defined in Policy & Objects > Objects > Schedules.

Select to enable the unit to block intra-SSID traffic.

Select to limit the number of clients permitted to connect simultaneously. Enter the limit value.

Select to enable some subnets to remain local to the remote FortiAP. Traffic for these networks is not routed through the WiFi Controller. Specify split-tunnel networks in the FortiAP Profile. See Remote WLAN FortiAPs.

Enter the ID of the VLAN this SSID belongs to. Enter 0 for non-VLAN operation. See Reserved VLAN IDs.

Select to enable explicit web proxy for the SSID.

Enable if you are using RADIUS-based single sign-on (SSO).

Optionally, enable and define secondary IP addresses. Administrative access can be enabled on secondary interfaces.