Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

FortiWiFi and FortiAP Configuration Guide

Configuring L3 Roaming for Bridge Mode SSIDs

L3 roaming inter-controller topology using bridge mode SSIDs supports two roaming modes:

  • Indirect Mode

    In indirect mode, the L3 handoff is handled by the mobility tunnel between the FortiGate Wireless Controllers.

  • Direct Mode

    In direct mode, the two FortiAPs must be able to reach each other with no NAT in the path and the L3 handoff occurs between the  FortiAPs directly.

Direct mode is preferred if it is feasible in the topology.

The following configurations require dynamic user VLAN assignment by RADIUS to be configured for RADIUS users per the steps in VLAN assignment by RADIUS, specifically, configuring RADIUS user attributes that are used for the VLAN ID assignment.

To configure Intra-Controller L3 roaming for a bridge mode SSID - CLI
  1. Configure the client-idle-rehome-timeout (default is 20 seconds):

    config wireless-controller timers
      set client-idle-rehome-timeout 20
    end
  2. configure the L3 roaming support bridge mode SSID and related VLAN interface:

     config wireless-controller vap
        edit "l3_br1"
            set ssid "L3Roaming_br1"
            set security wpa2-only-enterprise
            set auth radius
            set radius-server "wifi-radius"
            set local-bridging enable
            set schedule "always"
            set dynamic-vlan enable
            set l3-roaming enable
        next
    end
    config system interface
        edit "lan"
            set vdom "root"
            set ip 10.40.0.1 255.255.255.0
            set allowaccess ping https ssh http fabric
            set type hard-switch
            set stp enable
            set role lan
            set snmp-index 4
        next
    end
    config system interface
        edit "lan_100"
            set vdom "root"
            set ip 10.43.100.1 255.255.255.0
            set allowaccess ping
            set device-identification enable
            set role lan
            set snmp-index 10
            set interface "lan"
            set vlanid 100
        next
    end
    
  3. Assign L3 roaming VAP to FAP433F:

    config wireless-controller wtp-profile
        edit "433F"
            config platform
                set type 433F
                set ddscan enable
            end
            set handoff-sta-thresh 55
            config radio-1
                set mode disabled
            end
            config radio-2
                set band 802.11ax-5G
                set vap-all manual
                set vaps "l3_br1"
                set channel "36"
            end
            config radio-3
                set mode disabled
            end
        next
    end
    config wireless-controller wtp
        edit "FP433FXX00000000"
            set uuid b04f1cca-8528-51ec-2dc0-c744cbef4179
            set admin enable
            set wtp-profile "433F"
            config radio-2
            end
        next
    end
    
  4. Assign L3 roaming VAP to FAP831F:

    config wireless-controller wtp-profile
        edit "831F.1"
            config platform
                set type 831F
                set ddscan enable
            end
            set handoff-sta-thresh 55
            set allowaccess https ssh
            config radio-1
                set mode disabled
            end
            config radio-2
                set band 802.11ax-5G
                set power-level 99
                set vap-all manual
                set vaps "l3_br1"
                set channel "36" "40"
            end
            config radio-3
                set mode disabled
            end
        next
    end
    config wireless-controller wtp
        edit "FP831FXX00000000"
            set uuid b867ca7c-cbc5-51ec-d5ac-4a395282be68
            set admin enable
            set wtp-profile "831F.1"
            config radio-2
            end
        next
    end
    
To configure Inter-Controller L3 roaming for a bridge mode SSID - CLI

This configuration requires two FortiGate units. In order to enable L3 roaming supported VAP, both FortiGate units must have the same SSID, security, and passphrase.

The following example uses:

  • AC1 as FGT40F

    • FAP1 as FAP433E

  • AC2 as FGT81EP

    • FAP2 as FAP831F

  1. Configure the L3 roaming peer IP for AC1 (FGT-40F):

    config system interface
      edit "wan"
        set vdom "root"
        set ip 10.43.1.40 255.255.255.0
        set allowaccess ping https ssh http fabric
        set type physical
        set role wan
        set snmp-index 1
      next
    end
    config wireless-controller inter-controller
      set l3-roaming enable
      config inter-controller-peer
        edit 1
          set peer-ip 10.43.1.81
        next
      end
    end
    
    1. Configure the client-idle-rehome-timeout (default is 20 seconds):

      config wireless-controller timers
        set client-idle-rehome-timeout 20
      end
    2. Configure the L3 roaming support bridge mode SSID and related VLAN interface:

      config wireless-controller vap
          edit "l3_br1"
              set ssid "L3Roaming_br1"
              set security wpa2-only-enterprise
              set auth radius
              set radius-server "wifi-radius"
              set local-bridging enable
              set schedule "always"
              set dynamic-vlan enable
              set l3-roaming enable
              set l3-roaming-mode indirect
          next
      end
      config system interface
          edit "lan"
              set vdom "root"
              set ip 10.40.0.1 255.255.255.0
              set allowaccess ping https ssh http fabric
              set type hard-switch
              set stp enable
              set role lan
              set snmp-index 4
          next
      end
      config system interface
          edit "lan_100"
              set vdom "root"
              set ip 10.43.100.1 255.255.255.0
              set allowaccess ping
              set device-identification enable
              set role lan
              set snmp-index 10
              set interface "lan"
              set vlanid 100
          next
      end
      
    3. Assign L3 roaming VAP to FAP433F:

      config wireless-controller wtp-profile
          edit "433F"
              config platform
                  set type 433F
                  set ddscan enable
              end
              set handoff-sta-thresh 55
              config radio-1
                  set mode disabled
              end
              config radio-2
                  set band 802.11ax-5G
                  set vap-all manual
                  set vaps "l3_br1"
                  set channel "36"
              end
              config radio-3
                  set mode disabled
              end
          next
      end
      config wireless-controller wtp
          edit "FP433FXX00000000"
              set uuid b04f1cca-8528-51ec-2dc0-c744cbef4179
              set admin enable
              set wtp-profile "433F"
              config radio-2
              end
          next
      end
      
  2. Configure the L3 roaming peer IP for AC2 (FGT-81EP):

    config system interface
      edit "wan1"
        set vdom "root"
        set ip 10.43.1.81 255.255.255.0
        set allowaccess ping https ssh http fabric
        set type physical
        set role wan
        set snmp-index 1
      next
    end
    config wireless-controller inter-controller
      set l3-roaming enable
      config inter-controller-peer
        edit 1
          set peer-ip 10.43.1.40
        next
      end
    end
    
    1. Configure the client-idle-rehome-timeout (default is 20 seconds):

      config wireless-controller timers
        set client-idle-rehome-timeout 20
      end
    2. Configure the L3 roaming support bridge mode SSID and related VLAN interface:

      config wireless-controller vap
          edit "l3_br1"
              set ssid "L3Roaming_br1"
              set security wpa2-only-enterprise
              set auth radius
              set radius-server "wifi-radius"
              set local-bridging enable
              set schedule "always"
              set dynamic-vlan enable
              set l3-roaming enable
              set l3-roaming-mode indirect
          next
      end
      config system interface
          edit "lan_hw"
              set vdom "root"
              set ip 10.81.0.129 255.255.255.0
              set allowaccess ping https ssh http fabric
              set type hard-switch
              set stp enable
              set role lan
              set snmp-index 52
          next
      end
      config system interface
          edit "lan_100"
              set vdom "root"
              set ip 10.81.100.1 255.255.255.0
              set allowaccess ping
              set device-identification enable
              set role lan
              set snmp-index 34
              set interface "lan_hw"
              set vlanid 100
          next
      end
      
    3. Assign L3 roaming VAP to FAP831F:

      config wireless-controller wtp-profile
          edit "831F.1"
              config platform
                  set type 831F
                  set ddscan enable
              end
              set handoff-sta-thresh 55
              set allowaccess https ssh
              config radio-1
                  set mode disabled
              end
              config radio-2
                  set band 802.11ax-5G
                  set power-level 99
                  set vap-all manual
                  set vaps "l3_br1"
                  set channel "36" "40"
              end
              config radio-3
                  set mode disabled
              end
          next
      end
      config wireless-controller wtp
          edit "FP831FXX00000000"
              set uuid b867ca7c-cbc5-51ec-d5ac-4a395282be68
              set admin enable
              set wtp-profile "831F.1"
              config radio-2
              end
          next
      end
      
  3. Check the peer status from AC1 (FGT-40F):

    FortiGate-40F  # diagnose wireless-controller wlac -c ha
    WC fast failover info
        mode    : disabled 
        l3r     : enabled 
        peer cnt: 1 
                  FG81EPXX00000000 10.43.1.81:5246       UP 0
    
  4. Check the peer status from AC2 (FGT-81EP):

    FortiGate-81E-POE # diagnose wireless-controller wlac -c ha
    WC fast failover info
        mode    : disabled 
        l3r     : enabled 
        peer cnt: 1 
                  FGT40FXX00000000 10.43.1.40:5246       UP 0
    

Understanding L3 roaming events for inter-controller L3 roaming for a bridge mode SSID

When the wireless client is connected with "L3Roaming_br1" on AP1 in AC1, the client receives IP 10.43.100.2 from AP1 in AC1, bridged to “lan_100” VLAN interface:

FortiGate-40F # diagnose wireless-controller wlac -d sta online
   vf=0 wtp=2 rId=2 wlan=l3_br1 vlan_id=100 ip=10.43.100.2 ip6=fe80::c84:737e:2ba0:7ae2 mac=22:cf:0e:1a:7f:d2 vci= host= user=vlan0100 group=wifi-radius signal=-67 noise=-95 idle=6 bw=0 use=6 chan=36 radio_type=11AC security=wpa2_only_enterprise mpsk= encrypt=aes cp_authed=no l3r=1,0 G=0.0.0.0:0,0.0.0.0:0-0-0 -- 0.0.0.0:0 0,0 online=yes mimo=2

When the client leaves AP1 and roams towards AP2, it connects with the same SSID "L3Roaming_br1" on AP2. Wireless traffic passes from AP2 and is sent to AC2. Eventually the wireless traffic is transferred from AC2 to AC1 and traffic is maintained from AC1. The wireless client maintains the original IP of 10.43.100.2:

FortiGate-81E-POE # diagnose wireless-controller wlac -d sta online
   vf=0 wtp=10 rId=2 wlan=l3_br1 vlan_id=0 ip=10.43.100.2 ip6=:: mac=22:cf:0e:1a:7f:d2 vci= host= user=vlan0100 group=wifi-radius signal=-58 noise=-95 idle=1 bw=5 use=7 chan=36 radio_type=11AC security=wpa2_only_enterprise mpsk= encrypt=aes cp_authed=no l3r=0,1 G=0.0.0.0:0,0.0.0.0:0-0-0 -- 0.0.0.0:0 0,0 online=yes mimo=2

If the wireless client idle time exceeds client-idle-rehome-timeout, it triggers the rehome event. The wireless client will send a DHCP request and obtain a new IP address from AC2 (10.81.100.2). Now the wireless client traffic is maintained from AC2:

FortiGate-81E-POE # diagnose wireless-controller wlac -d sta online
   L vf=0 wtp=10 rId=2 wlan=l3_br1 vlan_id=100 ip=10.81.100.2 ip6=fe80::c84:737e:2ba0:7ae2 mac=22:cf:0e:1a:7f:d2 vci= host= user=vlan0100 group=wifi-radius signal=-55 noise=-95 idle=3 bw=0 use=6 chan=36 radio_type=11AC security=wpa2_only_enterprise mpsk= encrypt=aes cp_authed=no l3r=1,0 G=0.0.0.0:0,0.0.0.0:0-0-0 -- 0.0.0.0:0 0,0 online=yes mimo=2

Configuring L3 Roaming for Bridge Mode SSIDs

L3 roaming inter-controller topology using bridge mode SSIDs supports two roaming modes:

  • Indirect Mode

    In indirect mode, the L3 handoff is handled by the mobility tunnel between the FortiGate Wireless Controllers.

  • Direct Mode

    In direct mode, the two FortiAPs must be able to reach each other with no NAT in the path and the L3 handoff occurs between the  FortiAPs directly.

Direct mode is preferred if it is feasible in the topology.

The following configurations require dynamic user VLAN assignment by RADIUS to be configured for RADIUS users per the steps in VLAN assignment by RADIUS, specifically, configuring RADIUS user attributes that are used for the VLAN ID assignment.

To configure Intra-Controller L3 roaming for a bridge mode SSID - CLI
  1. Configure the client-idle-rehome-timeout (default is 20 seconds):

    config wireless-controller timers
      set client-idle-rehome-timeout 20
    end
  2. configure the L3 roaming support bridge mode SSID and related VLAN interface:

     config wireless-controller vap
        edit "l3_br1"
            set ssid "L3Roaming_br1"
            set security wpa2-only-enterprise
            set auth radius
            set radius-server "wifi-radius"
            set local-bridging enable
            set schedule "always"
            set dynamic-vlan enable
            set l3-roaming enable
        next
    end
    config system interface
        edit "lan"
            set vdom "root"
            set ip 10.40.0.1 255.255.255.0
            set allowaccess ping https ssh http fabric
            set type hard-switch
            set stp enable
            set role lan
            set snmp-index 4
        next
    end
    config system interface
        edit "lan_100"
            set vdom "root"
            set ip 10.43.100.1 255.255.255.0
            set allowaccess ping
            set device-identification enable
            set role lan
            set snmp-index 10
            set interface "lan"
            set vlanid 100
        next
    end
    
  3. Assign L3 roaming VAP to FAP433F:

    config wireless-controller wtp-profile
        edit "433F"
            config platform
                set type 433F
                set ddscan enable
            end
            set handoff-sta-thresh 55
            config radio-1
                set mode disabled
            end
            config radio-2
                set band 802.11ax-5G
                set vap-all manual
                set vaps "l3_br1"
                set channel "36"
            end
            config radio-3
                set mode disabled
            end
        next
    end
    config wireless-controller wtp
        edit "FP433FXX00000000"
            set uuid b04f1cca-8528-51ec-2dc0-c744cbef4179
            set admin enable
            set wtp-profile "433F"
            config radio-2
            end
        next
    end
    
  4. Assign L3 roaming VAP to FAP831F:

    config wireless-controller wtp-profile
        edit "831F.1"
            config platform
                set type 831F
                set ddscan enable
            end
            set handoff-sta-thresh 55
            set allowaccess https ssh
            config radio-1
                set mode disabled
            end
            config radio-2
                set band 802.11ax-5G
                set power-level 99
                set vap-all manual
                set vaps "l3_br1"
                set channel "36" "40"
            end
            config radio-3
                set mode disabled
            end
        next
    end
    config wireless-controller wtp
        edit "FP831FXX00000000"
            set uuid b867ca7c-cbc5-51ec-d5ac-4a395282be68
            set admin enable
            set wtp-profile "831F.1"
            config radio-2
            end
        next
    end
    
To configure Inter-Controller L3 roaming for a bridge mode SSID - CLI

This configuration requires two FortiGate units. In order to enable L3 roaming supported VAP, both FortiGate units must have the same SSID, security, and passphrase.

The following example uses:

  • AC1 as FGT40F

    • FAP1 as FAP433E

  • AC2 as FGT81EP

    • FAP2 as FAP831F

  1. Configure the L3 roaming peer IP for AC1 (FGT-40F):

    config system interface
      edit "wan"
        set vdom "root"
        set ip 10.43.1.40 255.255.255.0
        set allowaccess ping https ssh http fabric
        set type physical
        set role wan
        set snmp-index 1
      next
    end
    config wireless-controller inter-controller
      set l3-roaming enable
      config inter-controller-peer
        edit 1
          set peer-ip 10.43.1.81
        next
      end
    end
    
    1. Configure the client-idle-rehome-timeout (default is 20 seconds):

      config wireless-controller timers
        set client-idle-rehome-timeout 20
      end
    2. Configure the L3 roaming support bridge mode SSID and related VLAN interface:

      config wireless-controller vap
          edit "l3_br1"
              set ssid "L3Roaming_br1"
              set security wpa2-only-enterprise
              set auth radius
              set radius-server "wifi-radius"
              set local-bridging enable
              set schedule "always"
              set dynamic-vlan enable
              set l3-roaming enable
              set l3-roaming-mode indirect
          next
      end
      config system interface
          edit "lan"
              set vdom "root"
              set ip 10.40.0.1 255.255.255.0
              set allowaccess ping https ssh http fabric
              set type hard-switch
              set stp enable
              set role lan
              set snmp-index 4
          next
      end
      config system interface
          edit "lan_100"
              set vdom "root"
              set ip 10.43.100.1 255.255.255.0
              set allowaccess ping
              set device-identification enable
              set role lan
              set snmp-index 10
              set interface "lan"
              set vlanid 100
          next
      end
      
    3. Assign L3 roaming VAP to FAP433F:

      config wireless-controller wtp-profile
          edit "433F"
              config platform
                  set type 433F
                  set ddscan enable
              end
              set handoff-sta-thresh 55
              config radio-1
                  set mode disabled
              end
              config radio-2
                  set band 802.11ax-5G
                  set vap-all manual
                  set vaps "l3_br1"
                  set channel "36"
              end
              config radio-3
                  set mode disabled
              end
          next
      end
      config wireless-controller wtp
          edit "FP433FXX00000000"
              set uuid b04f1cca-8528-51ec-2dc0-c744cbef4179
              set admin enable
              set wtp-profile "433F"
              config radio-2
              end
          next
      end
      
  2. Configure the L3 roaming peer IP for AC2 (FGT-81EP):

    config system interface
      edit "wan1"
        set vdom "root"
        set ip 10.43.1.81 255.255.255.0
        set allowaccess ping https ssh http fabric
        set type physical
        set role wan
        set snmp-index 1
      next
    end
    config wireless-controller inter-controller
      set l3-roaming enable
      config inter-controller-peer
        edit 1
          set peer-ip 10.43.1.40
        next
      end
    end
    
    1. Configure the client-idle-rehome-timeout (default is 20 seconds):

      config wireless-controller timers
        set client-idle-rehome-timeout 20
      end
    2. Configure the L3 roaming support bridge mode SSID and related VLAN interface:

      config wireless-controller vap
          edit "l3_br1"
              set ssid "L3Roaming_br1"
              set security wpa2-only-enterprise
              set auth radius
              set radius-server "wifi-radius"
              set local-bridging enable
              set schedule "always"
              set dynamic-vlan enable
              set l3-roaming enable
              set l3-roaming-mode indirect
          next
      end
      config system interface
          edit "lan_hw"
              set vdom "root"
              set ip 10.81.0.129 255.255.255.0
              set allowaccess ping https ssh http fabric
              set type hard-switch
              set stp enable
              set role lan
              set snmp-index 52
          next
      end
      config system interface
          edit "lan_100"
              set vdom "root"
              set ip 10.81.100.1 255.255.255.0
              set allowaccess ping
              set device-identification enable
              set role lan
              set snmp-index 34
              set interface "lan_hw"
              set vlanid 100
          next
      end
      
    3. Assign L3 roaming VAP to FAP831F:

      config wireless-controller wtp-profile
          edit "831F.1"
              config platform
                  set type 831F
                  set ddscan enable
              end
              set handoff-sta-thresh 55
              set allowaccess https ssh
              config radio-1
                  set mode disabled
              end
              config radio-2
                  set band 802.11ax-5G
                  set power-level 99
                  set vap-all manual
                  set vaps "l3_br1"
                  set channel "36" "40"
              end
              config radio-3
                  set mode disabled
              end
          next
      end
      config wireless-controller wtp
          edit "FP831FXX00000000"
              set uuid b867ca7c-cbc5-51ec-d5ac-4a395282be68
              set admin enable
              set wtp-profile "831F.1"
              config radio-2
              end
          next
      end
      
  3. Check the peer status from AC1 (FGT-40F):

    FortiGate-40F  # diagnose wireless-controller wlac -c ha
    WC fast failover info
        mode    : disabled 
        l3r     : enabled 
        peer cnt: 1 
                  FG81EPXX00000000 10.43.1.81:5246       UP 0
    
  4. Check the peer status from AC2 (FGT-81EP):

    FortiGate-81E-POE # diagnose wireless-controller wlac -c ha
    WC fast failover info
        mode    : disabled 
        l3r     : enabled 
        peer cnt: 1 
                  FGT40FXX00000000 10.43.1.40:5246       UP 0
    

Understanding L3 roaming events for inter-controller L3 roaming for a bridge mode SSID

When the wireless client is connected with "L3Roaming_br1" on AP1 in AC1, the client receives IP 10.43.100.2 from AP1 in AC1, bridged to “lan_100” VLAN interface:

FortiGate-40F # diagnose wireless-controller wlac -d sta online
   vf=0 wtp=2 rId=2 wlan=l3_br1 vlan_id=100 ip=10.43.100.2 ip6=fe80::c84:737e:2ba0:7ae2 mac=22:cf:0e:1a:7f:d2 vci= host= user=vlan0100 group=wifi-radius signal=-67 noise=-95 idle=6 bw=0 use=6 chan=36 radio_type=11AC security=wpa2_only_enterprise mpsk= encrypt=aes cp_authed=no l3r=1,0 G=0.0.0.0:0,0.0.0.0:0-0-0 -- 0.0.0.0:0 0,0 online=yes mimo=2

When the client leaves AP1 and roams towards AP2, it connects with the same SSID "L3Roaming_br1" on AP2. Wireless traffic passes from AP2 and is sent to AC2. Eventually the wireless traffic is transferred from AC2 to AC1 and traffic is maintained from AC1. The wireless client maintains the original IP of 10.43.100.2:

FortiGate-81E-POE # diagnose wireless-controller wlac -d sta online
   vf=0 wtp=10 rId=2 wlan=l3_br1 vlan_id=0 ip=10.43.100.2 ip6=:: mac=22:cf:0e:1a:7f:d2 vci= host= user=vlan0100 group=wifi-radius signal=-58 noise=-95 idle=1 bw=5 use=7 chan=36 radio_type=11AC security=wpa2_only_enterprise mpsk= encrypt=aes cp_authed=no l3r=0,1 G=0.0.0.0:0,0.0.0.0:0-0-0 -- 0.0.0.0:0 0,0 online=yes mimo=2

If the wireless client idle time exceeds client-idle-rehome-timeout, it triggers the rehome event. The wireless client will send a DHCP request and obtain a new IP address from AC2 (10.81.100.2). Now the wireless client traffic is maintained from AC2:

FortiGate-81E-POE # diagnose wireless-controller wlac -d sta online
   L vf=0 wtp=10 rId=2 wlan=l3_br1 vlan_id=100 ip=10.81.100.2 ip6=fe80::c84:737e:2ba0:7ae2 mac=22:cf:0e:1a:7f:d2 vci= host= user=vlan0100 group=wifi-radius signal=-55 noise=-95 idle=3 bw=0 use=6 chan=36 radio_type=11AC security=wpa2_only_enterprise mpsk= encrypt=aes cp_authed=no l3r=1,0 G=0.0.0.0:0,0.0.0.0:0-0-0 -- 0.0.0.0:0 0,0 online=yes mimo=2