VLAN assignment by Name Tag

Typically, users can be assigned to VLANs dynamically according to the Tunnel-Private-Group-Id RADIUS attribute returned from the Access-Accept message. The value can either match a particular VLAN-ID on a VLAN interface, or a text string that matches a VLAN interface name.

However, there is a another option to match based on a vlan-name table defined under the virtual AP.

Example use case

In the following example scenario, the customer site has set up the following topology:

• FortiGate manages a FortiSwitch and a FortiAP which is connecting through the FortiSwitch;
• FortiAP broadcasts a bridge mode SSID with dynamc-vlan enabled;
• FortiGate needs to assign VLAN-ID=100 on the station if vlan-name is "print", and assign VLAN-ID=200 on the station if vlan-name is "voip".

VLAN Name	VLAN ID
print	100
voip	200

Instead of creating VLAN interfaces on the FortiGate and naming them "print" and "voip" respectively, you can add one vlan-name table in the SSID:

config wireless-controller vap
    edit "wifi.fap.02"
        set ssid "wifi-ssid.fap.02"
        set security wpa2-only-enterprise
        set auth radius
        set radius-server "peap"
        set local-bridging enable
        set dynamic-vlan enable
        config vlan-name
            edit "print"
                set vlan-id 100
            next
            edit "voip"
                set vlan-id 200
            next
        end
    next
end

After the wireless station connects the SSID, when its attribute "Tunnel-Private-Group-Id" is "print", it will be assigned with VLAN-ID=100; when its attribute "Tunnel-Private-Group-Id" is "voip", it will be assigned with VLAN-ID=200.

To create user accounts in the radius server (freeradius)

voip      Cleartext-Password := "123456"
          Tunnel-Type = "VLAN",
          Tunnel-Medium-Type = "IEEE-802",
          Tunnel-Private-Group-Id = voip
print     Cleartext-Password := "123456"
          Tunnel-Type = "VLAN",
          Tunnel-Medium-Type = "IEEE-802",
          Tunnel-Private-Group-Id = print

To verify the client connects and recieved the correct VLAN ID and IP address

   vf=1 wtp=2 rId=2 wlan=wifi.fap.02 vlan_id=100 ip=10.100.80.101 ip6=:: mac=f8:e4:e3:d8:5e:af vci= host=WiFi-Client-2 user=print group=peap signal=-39 noise=-95 idle=0 bw=2 use=6 chan=149 radio_type=11AX_5G security=wpa2_only_enterprise mpsk= encrypt=aes cp_authed=no online=yes mimo=2

   vf=1 wtp=2 rId=2 wlan=wifi.fap.02 vlan_id=200 ip=10.200.80.101 ip6=:: mac=f8:e4:e3:d8:5e:af vci= host=WiFi-Client-2 user=voip group=peap signal=-39 noise=-95 idle=20 bw=0 use=6 chan=149 radio_type=11AX_5G security=wpa2_only_enterprise mpsk= encrypt=aes cp_authed=no online=yes mimo=2