Configuring a meshed WiFi network
To configure a mesh WiFi network, perform the following tasks:
- Creating the mesh root SSID
- Creating the FortiAP profile
- Configuring the mesh root AP
- Configuring the mesh leaf FortiAPs
- Authorizing leaf APs
- Creating security policies
- Viewing the status of the mesh network
This section assumes that the end-user SSIDs already exist.
Creating the mesh root SSID
The mesh route SSID is the radio backhaul that conveys the user SSID traffic to the leaf FortiAPs.
To configure the mesh root SSID
- Go to WiFi and Switch Controller > SSIDs and select Create New > SSID.
- Enter a Name for the WiFi interface.
- In Traffic Mode, select Mesh Downlink.
- Enter the SSID.
- Set Security Mode to WPA2 Personal and enter the Pre-shared key.
Remember the key because you need to enter it for the leaf FortiAP configuration.
- Select OK.
Creating the FortiAP profile
Create a FortiAP profile for the meshed FortiAPs. If more than one FortiAP model is involved, you need to create a profile for each model. Typically, the profile is configured so that Radio 1 (5GHz) carries the mesh backhaul SSID while Radio 2 (2.4GHz) carries the SSIDs to which users connect.
For Radio 1, use the Select SSIDs option and choose only the backhaul SSID. The radio that carries the backhaul traffic must not carry other SSIDs.
Radio 2 carries user SSIDs and shouldn't carry the backhaul. Use the Select SSIDs option and choose the networks that you want to provide.
For more information, see Creating a FortiAP profile.
Configuring the mesh root AP
The mesh root AP can be either a FortiWiFi unit’s built-in AP or a FortiAP unit.
To enable a FortiWiFi unit’s local radio as mesh root
- On the FortiWiFi unit, go to WiFi & and Switch Controller > Local WiFi Radio.
- Select Enable WiFi Radio.
- In SSID, select Select SSIDs, then select the mesh root SSID.
- Optionally, adjust Tx Power or select Auto Tx Power Control.
- Select Apply.
In a network with multiple wireless controllers, make sure that each mesh root has a unique SSID. Other controllers using the same mesh root SSID may be detected as fake or rogue APs. Go to WiFi and Switch Controller > SSIDs to change the SSID. |
To configure a network interface for the mesh root FortiAP unit
- On the FortiGate unit, go to Network > Interfaces, and edit the interface to which the AP unit connects.
- In Addressing mode, select Manual.
-
In IP/Network Mask, enter an IP address and netmask for the interface.
- In the Administrative Access section, go to IPv4 and select the Security Fabric Connection checkbox.
-
When FortiAP units are connected to the interface on FortiGate (directly or through a switch), you can go to the Edit Interface section and set the Role to LAN.
Selecting the LAN role loads the DHCP Server toggle. If you enable DHCP Server, the GUI can automatically set the DHCP IP range based on the interface IP address.
- Click OK.
At this point you can connect the mesh root FortiAP (see below). If you are planning to configure leaf FortiAPs through the wireless controller (see Configuring the mesh leaf FortiAPs), then connect the root unit later.
To enable the root FortiAP unit
- Connect the root FortiAP unit’s Ethernet port to the FortiGate network interface that you configured.
- On the FortiGate unit, go to WiFi and Switch Controller > Managed FortiAPs.
If the root FortiAP unit is not listed, wait 15 seconds and select Refresh. Repeat if necessary. If the unit is still missing after a minute or two, power cycle the root FortiAP unit and try again.
- Right-click the FortiAP entry and choose your profile from the Assign Profile submenu.
- Right-click the FortiAP entry and select Authorize.
Initially, the State of the FortiAP unit is Offline. Periodically click Refresh to update the status. Within about two minutes, the state changes to Online.
- Select OK.
Configuring the mesh leaf FortiAPs
The FortiAP units that serve as leaf nodes must be preconfigured. This involves changing the FortiAP unit's internal configuration. You can do this by direct connection or through the FortiGate wireless controller.
Method 1: Direct connection to the FortiAP
- Configure the computer IP as 192.168.1.3.
- Connect the computer to the FortiAP unit's Ethernet port and use the default IP address, 192.168.1.2.
- Log in to the FortiAP as admin. By default, no password is set.
- Enter the following commands:
- If you are using the GUI, go to Connectivity > Uplink and select the Mesh option. Then enter the Mesh AP SSID and Mesh AP Password (pre-shared key).
- If you are using the FortiAP CLI (SSH), enter the following commands, substituting your own SSID, password (pre-shared key), and security mode:
cfg -a MESH_AP_TYPE=1
cfg -a MESH_AP_SSID=fortinet.mesh.root
cfg -a MESH_AP_PASSWD=hardtoguess
cfg -a MESH_AP_SECURITY=2
cfg -c
exit
Note: By default, MESH_AP_SECURITY is set to 0 (Open network). Depending on the security mode of your mesh backhaul SSID, you must explicitly set it to either 1 (WPA/WPA2-Personal) or 2 (WPA3-SAE).
- Disconnect the computer.
- Power down the FortiAP.
- Repeat the preceding steps for each leaf FortiAP.
Method 2: Connecting through the FortiGate unit
- Connect the Ethernet port on the leaf FortiAP to the FortiGate network interface that you configured for FortiAPs. Connect the FortiAP unit to a power source unless PoE is used.
- On the FortiGate unit, go to WiFi and Switch Controller > Managed FortiAPs.
If the FortiAP unit is not listed, wait 15 seconds and select Refresh. Repeat if necessary. If the unit is still missing after a minute or two, power cycle the FortiAP unit and try again.
- Select the discovered FortiAP unit and authorize it. Click Refresh every 10 seconds until the State indicator changes to Online.
- Right-click the FortiAP and select >_Connect to CLI. The CLI Console window opens. Log in as "admin".
- Enter the following commands, substituting your own SSID, password (pre-shared key), and security mode:
cfg -a MESH_AP_TYPE=1
cfg -a MESH_AP_SSID=fortinet.mesh.root
cfg -a MESH_AP_PASSWD=hardtoguess
cfg -a MESH_AP_SECURITY=2
cfg -c
exit
Note: By default, MESH_AP_SECURITY is set to 0 (Open network). Depending on the security mode of your mesh backhaul SSID, you must explicitly set it to either 1 (WPA/WPA2-Personal) or 2 (WPA3-SAE).
- Disconnect the FortiAP and delete it from the Managed FortiAP list.
- Repeat the preceding steps for each leaf FortiAP.
Authorizing leaf APs
When the root FortiAP is connected and online, apply power to the preconfigured leaf FortiAPs. The leaf FortiAPs will connect themselves wirelessly to the WiFi Controller through the mesh network. You must authorize each unit.
- On the FortiGate unit, go to WiFi and Switch Controller > Managed FortiAPs. Periodically select Refresh until the FortiAP unit is listed. This can take up to three minutes.
The State of the FortiAP unit should be Waiting for Authorization.
- Right-click the FortiAP entry and choose your profile from the Assign Profile submenu.
- Right-click the FortiAP entry and select Authorize.
Initially, the State of the FortiAP unit is Offline. Periodically click Refresh to update the status. Within about two minutes, the state changes to Online.
Creating security policies
To permit traffic to flow from the end-user WiFi network to the network interfaces for the Internet and other networks, you need to create security policies and enable NAT.
Viewing the status of the mesh network
On the FortiGate unit, go to WiFi and Switch Controller > Managed FortiAPs to view the list of APs.
The SSIDs column lists the SSID of each FortiAP radio and uses icons to show the Traffic mode of each radio.
Bridge |
|
Mesh |
|
Tunnel |
|
To see more information about each radio, mouse over the SSIDs information.