Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

FortiWiFi and FortiAP Configuration Guide

Configuring the FortiGate interface to manage FortiAP units

This guide describes how to configure a FortiGate interface to manage FortiAPs.

Based on the above topology, this example uses port16 as the interface used to manage connection to FortiAPs.

  1. Enable a DHCP server on port16:
    1. From FortiGate, go to Network > Interfaces.
    2. Edit port16.
    3. In the IP/Network Mask field, enter an IP address for port16.
    4. Enable DHCP Server, keeping the default settings.
  2. As it is a minimum management requirement that FortiAP establish a CAPWAP tunnel with the FortiGate, you must enable CAPWAP access on port16 to allow it to manage FortiAPs:
    1. Go to Network > Interfaces.
    2. Double-click port16.
    3. Under Administrative Access, select Security Fabric Connection.
    4. Click OK.
  3. If required, you can enable the VCI-match feature using the CLI. When VCI-match is enabled, only devices with a VCI name that matches the preconfigured string can acquire an IP address from the DHCP server. To configure VCI-match, run the following commands:

    config system dhcp server

    edit 1

    set interface port16

    set vci-match enable

    set vci-string "FortiAP"

    next

    end

  4. To create a new FortiAP entry automatically when a new FortiAP unit is discovered, run the following command. By default, this option is enabled.

    config system interface

    edit port16

    set allow-access fabric

    set ap-discover enable

    next

    end

  5. To allow FortiGate to authorize a newly discovered FortiAP to be controlled by the FortiGate, run the following command. By default, this option is disabled.

    config system interface

    edit port16

    set allow-access fabric

    set auto-auth-extension-device enable

    next

    end

Note

For more information, see Configuring the network interface for the AP unit.

Configuring the FortiGate interface to manage FortiAP units

This guide describes how to configure a FortiGate interface to manage FortiAPs.

Based on the above topology, this example uses port16 as the interface used to manage connection to FortiAPs.

  1. Enable a DHCP server on port16:
    1. From FortiGate, go to Network > Interfaces.
    2. Edit port16.
    3. In the IP/Network Mask field, enter an IP address for port16.
    4. Enable DHCP Server, keeping the default settings.
  2. As it is a minimum management requirement that FortiAP establish a CAPWAP tunnel with the FortiGate, you must enable CAPWAP access on port16 to allow it to manage FortiAPs:
    1. Go to Network > Interfaces.
    2. Double-click port16.
    3. Under Administrative Access, select Security Fabric Connection.
    4. Click OK.
  3. If required, you can enable the VCI-match feature using the CLI. When VCI-match is enabled, only devices with a VCI name that matches the preconfigured string can acquire an IP address from the DHCP server. To configure VCI-match, run the following commands:

    config system dhcp server

    edit 1

    set interface port16

    set vci-match enable

    set vci-string "FortiAP"

    next

    end

  4. To create a new FortiAP entry automatically when a new FortiAP unit is discovered, run the following command. By default, this option is enabled.

    config system interface

    edit port16

    set allow-access fabric

    set ap-discover enable

    next

    end

  5. To allow FortiGate to authorize a newly discovered FortiAP to be controlled by the FortiGate, run the following command. By default, this option is disabled.

    config system interface

    edit port16

    set allow-access fabric

    set auto-auth-extension-device enable

    next

    end

Note

For more information, see Configuring the network interface for the AP unit.