Fortinet black logo

Handbook

Configuring a meshed WiFi network

6.0.0
Copy Link
Copy Doc ID 4afb0436-a998-11e9-81a4-00505692583a:124271
Download PDF

Configuring a meshed WiFi network

You need to:

  • Create the mesh root SSID.
  • Create the FortiAP profile.
  • Configure mesh leaf AP units.
  • Configure the mesh root AP, either a FortiWiFi unit’s local radio or a FortiAP unit.
  • Authorize the mesh leaf units when they connect to the WiFi Controller.
  • Create security policies.

This section assumes that the end-user SSIDs already exist.

Creating the mesh root SSID

The mesh route SSID is the radio backhaul that conveys the user SSID traffic to the leaf FortiAPs.

To configure the mesh root SSID
  1. Go to WiFi & Switch Controller > SSID and select Create New > SSID.
  2. Enter a Name for the WiFi interface.
  3. In Traffic Mode, select Mesh Downlink.
  4. Enter the SSID.
  5. Set Security Mode to WPA2 Personal and enter the Pre-shared key.

    Remember the key because you need to enter it into the configurations of the leaf FortiAPs.

  6. Select OK.

Creating the FortiAP profile

Create a FortiAP profile for the meshed FortiAPs. If more than one FortiAP model is involved, you need to create a profile for each model. Typically, the profile is configured so that Radio 1 (5GHz) carries the mesh backhaul SSID while Radio 2 (2.4GHz) carries the SSIDs to which users connect.

For Radio 1, use the Select SSIDs option and choose only the backhaul SSID. The radio that carries the backhaul traffic must not carry other SSIDs.

Radio 2 carries user SSIDs and shouldn't carry the backhaul. Use the Select SSIDs option and choose the networks that you want to provide.

For more information, see WiFi LAN configuration.

Configuring the mesh root AP

The mesh root AP can be either a FortiWiFi unit’s built-in AP or a FortiAP unit.

To enable a FortiWiFi unit’s local radio as mesh root
  1. On the FortiWiFi unit, go to WiFi & Switch Controller > Local WiFi Radio.
  2. Select Enable WiFi Radio.
  3. In SSID, select Select SSIDs, then select the mesh root SSID.
  4. Optionally, adjust Tx Power or select Auto Tx Power Control.
  5. Select Apply.

note icon

In a network with multiple wireless controllers, make sure that each mesh root has a unique SSID. Other controllers using the same mesh root SSID may be detected as fake or rogue APs. Go to WiFi & Switch Controller > SSID to change the SSID.

To configure a network interface for the mesh root FortiAP unit
  1. On the FortiGate unit, go to Network > Interfaces.
  2. Edit the interface that the FortiAP unit connects to.
  3. Make sure that Role is LAN.
  4. In Addressing mode, select Manual.
  5. In IP/Network Mask, enter an IP address and netmask for the interface.

    If enabled, DHCP provides addresses to connected devices. To maximize the number of available addresses, the interface address must end with 1, for example 192.168.10.1.

  6. Under Administrative Access, for IPv4, enable CAPWAP.
  7. Click OK.

At this point you can connect the mesh root FortiAP (see below). If you are planning to configure leaf FortiAPs through the wireless controller (see Configuring a meshed WiFi network), connect the root unit later.

To enable the root FortiAP unit
  1. Connect the root FortiAP unit’s Ethernet port to the FortiGate network interface that you configured.
  2. On the FortiGate unit, go to WiFi & Switch Controller > Managed FortiAPs.

    If the root FortiAP unit is not listed, wait 15 seconds and select Refresh. Repeat if necessary. If the unit is still missing after a minute or two, power cycle the root FortiAP unit and try again.

  3. Right-click the FortiAP entry and choose your profile from the Assign Profile submenu.
  4. Right-click the FortiAP entry and select Authorize.

    Initially, the State of the FortiAP unit is Offline. Periodically click Refresh to update the status. Within about two minutes, the state changes to Online.

  5. Select OK.

Configuring the mesh leaf FortiAPs

The FortiAP units that serve as leaf nodes must be preconfigured. This involves changing the FortiAP unit's internal configuration. You can do this by direct connection or through the FortiGate wireless controller.

Method 1: Direct connection to the FortiAP
  1. Configure the computer IP as 192.168.1.3.
  2. Connect the computer to the FortiAP unit's Ethernet port and use the default IP address, 192.168.1.2.
  3. Log in to the FortiAP as admin. By default, no password is set.
  4. Enter the following commands:
    1. If you are using the GUI, go to Connectivity > Uplink and select the Mesh option. Then enter the Mesh AP SSID and Mesh AP Password (pre-shared key).
    2. If you are using the FortiAP CLI (Telnet or SSH), enter the following commands, substituting your own SSID and password (pre-shared key):

      cfg -a MESH_AP_TYPE=1

      cfg -a MESH_AP_SSID=fortinet.mesh.root

      cfg -a MESH_AP_PASSWD=hardtoguess

      cfg -c

      exit

  5. Disconnect the computer.
  6. Power down the FortiAP.
  7. Repeat the preceding steps for each leaf FortiAP.
Method 2: Connecting through the FortiGate unit
  1. Connect the Ethernet port on the leaf FortiAP to the FortiGate network interface that you configured for FortiAPs. Connect the FortiAP unit to a power source unless PoE is used.
  2. On the FortiGate unit, go to WiFi & Switch Controller > Managed FortiAPs.

    If the FortiAP unit is not listed, wait 15 seconds and select Refresh. Repeat if necessary. If the unit is still missing after a minute or two, power cycle the FortiAP unit and try again.

  3. Select the discovered FortiAP unit and authorize it. Click Refresh every 10 seconds until the State indicator changes to Online.
  4. Right-click the FortiAP and select >_Connect to CLI. The CLI Console window opens. Log in as "admin".
  5. Enter the following commands, substituting your own SSID and password (pre-shared key):

    cfg -a MESH_AP_TYPE=1

    cfg -a MESH_AP_SSID=fortinet.mesh.root

    cfg -a MESH_AP_PASSWD=hardtoguess

    cfg -c

    exit

  6. Disconnect the FortiAP and delete it from the Managed FortiAP list.
  7. Repeat the preceding steps for each leaf FortiAP.

Authorizing leaf APs

When the root FortiAP is connected and online, apply power to the preconfigured leaf FortiAPs. The leaf FortiAPs will connect themselves wirelessly to the WiFi Controller through the mesh network. You must authorize each unit.

  1. On the FortiGate unit, go to WiFi & Switch Controller > Managed FortiAPs. Periodically select Refresh until the FortiAP unit is listed. This can take up to three minutes.

    The State of the FortiAP unit should be Waiting for Authorization.

  2. Right-click the FortiAP entry and choose your profile from the Assign Profile submenu.
  3. Right-click the FortiAP entry and select Authorize.

    Initially, the State of the FortiAP unit is Offline. Periodically click Refresh to update the status. Within about two minutes, the state changes to Online.

Creating security policies

To permit traffic to flow from the end-user WiFi network to the network interfaces for the Internet and other networks, you need to create security policies and enable NAT.

Viewing the status of the mesh network

On the FortiGate unit, go to WiFi & Switch Controller > Managed FortiAPs to view the list of APs.

The Connected Via column lists the IP address of each FortiAP and uses icons to show whether the FortiAP is connected by Ethernet or mesh.

Ethernet

Mesh

To see how the FortiGate wireless controller connects to the FortiAP, mouse over the Connected Via information.

Configuring a meshed WiFi network

You need to:

  • Create the mesh root SSID.
  • Create the FortiAP profile.
  • Configure mesh leaf AP units.
  • Configure the mesh root AP, either a FortiWiFi unit’s local radio or a FortiAP unit.
  • Authorize the mesh leaf units when they connect to the WiFi Controller.
  • Create security policies.

This section assumes that the end-user SSIDs already exist.

Creating the mesh root SSID

The mesh route SSID is the radio backhaul that conveys the user SSID traffic to the leaf FortiAPs.

To configure the mesh root SSID
  1. Go to WiFi & Switch Controller > SSID and select Create New > SSID.
  2. Enter a Name for the WiFi interface.
  3. In Traffic Mode, select Mesh Downlink.
  4. Enter the SSID.
  5. Set Security Mode to WPA2 Personal and enter the Pre-shared key.

    Remember the key because you need to enter it into the configurations of the leaf FortiAPs.

  6. Select OK.

Creating the FortiAP profile

Create a FortiAP profile for the meshed FortiAPs. If more than one FortiAP model is involved, you need to create a profile for each model. Typically, the profile is configured so that Radio 1 (5GHz) carries the mesh backhaul SSID while Radio 2 (2.4GHz) carries the SSIDs to which users connect.

For Radio 1, use the Select SSIDs option and choose only the backhaul SSID. The radio that carries the backhaul traffic must not carry other SSIDs.

Radio 2 carries user SSIDs and shouldn't carry the backhaul. Use the Select SSIDs option and choose the networks that you want to provide.

For more information, see WiFi LAN configuration.

Configuring the mesh root AP

The mesh root AP can be either a FortiWiFi unit’s built-in AP or a FortiAP unit.

To enable a FortiWiFi unit’s local radio as mesh root
  1. On the FortiWiFi unit, go to WiFi & Switch Controller > Local WiFi Radio.
  2. Select Enable WiFi Radio.
  3. In SSID, select Select SSIDs, then select the mesh root SSID.
  4. Optionally, adjust Tx Power or select Auto Tx Power Control.
  5. Select Apply.

note icon

In a network with multiple wireless controllers, make sure that each mesh root has a unique SSID. Other controllers using the same mesh root SSID may be detected as fake or rogue APs. Go to WiFi & Switch Controller > SSID to change the SSID.

To configure a network interface for the mesh root FortiAP unit
  1. On the FortiGate unit, go to Network > Interfaces.
  2. Edit the interface that the FortiAP unit connects to.
  3. Make sure that Role is LAN.
  4. In Addressing mode, select Manual.
  5. In IP/Network Mask, enter an IP address and netmask for the interface.

    If enabled, DHCP provides addresses to connected devices. To maximize the number of available addresses, the interface address must end with 1, for example 192.168.10.1.

  6. Under Administrative Access, for IPv4, enable CAPWAP.
  7. Click OK.

At this point you can connect the mesh root FortiAP (see below). If you are planning to configure leaf FortiAPs through the wireless controller (see Configuring a meshed WiFi network), connect the root unit later.

To enable the root FortiAP unit
  1. Connect the root FortiAP unit’s Ethernet port to the FortiGate network interface that you configured.
  2. On the FortiGate unit, go to WiFi & Switch Controller > Managed FortiAPs.

    If the root FortiAP unit is not listed, wait 15 seconds and select Refresh. Repeat if necessary. If the unit is still missing after a minute or two, power cycle the root FortiAP unit and try again.

  3. Right-click the FortiAP entry and choose your profile from the Assign Profile submenu.
  4. Right-click the FortiAP entry and select Authorize.

    Initially, the State of the FortiAP unit is Offline. Periodically click Refresh to update the status. Within about two minutes, the state changes to Online.

  5. Select OK.

Configuring the mesh leaf FortiAPs

The FortiAP units that serve as leaf nodes must be preconfigured. This involves changing the FortiAP unit's internal configuration. You can do this by direct connection or through the FortiGate wireless controller.

Method 1: Direct connection to the FortiAP
  1. Configure the computer IP as 192.168.1.3.
  2. Connect the computer to the FortiAP unit's Ethernet port and use the default IP address, 192.168.1.2.
  3. Log in to the FortiAP as admin. By default, no password is set.
  4. Enter the following commands:
    1. If you are using the GUI, go to Connectivity > Uplink and select the Mesh option. Then enter the Mesh AP SSID and Mesh AP Password (pre-shared key).
    2. If you are using the FortiAP CLI (Telnet or SSH), enter the following commands, substituting your own SSID and password (pre-shared key):

      cfg -a MESH_AP_TYPE=1

      cfg -a MESH_AP_SSID=fortinet.mesh.root

      cfg -a MESH_AP_PASSWD=hardtoguess

      cfg -c

      exit

  5. Disconnect the computer.
  6. Power down the FortiAP.
  7. Repeat the preceding steps for each leaf FortiAP.
Method 2: Connecting through the FortiGate unit
  1. Connect the Ethernet port on the leaf FortiAP to the FortiGate network interface that you configured for FortiAPs. Connect the FortiAP unit to a power source unless PoE is used.
  2. On the FortiGate unit, go to WiFi & Switch Controller > Managed FortiAPs.

    If the FortiAP unit is not listed, wait 15 seconds and select Refresh. Repeat if necessary. If the unit is still missing after a minute or two, power cycle the FortiAP unit and try again.

  3. Select the discovered FortiAP unit and authorize it. Click Refresh every 10 seconds until the State indicator changes to Online.
  4. Right-click the FortiAP and select >_Connect to CLI. The CLI Console window opens. Log in as "admin".
  5. Enter the following commands, substituting your own SSID and password (pre-shared key):

    cfg -a MESH_AP_TYPE=1

    cfg -a MESH_AP_SSID=fortinet.mesh.root

    cfg -a MESH_AP_PASSWD=hardtoguess

    cfg -c

    exit

  6. Disconnect the FortiAP and delete it from the Managed FortiAP list.
  7. Repeat the preceding steps for each leaf FortiAP.

Authorizing leaf APs

When the root FortiAP is connected and online, apply power to the preconfigured leaf FortiAPs. The leaf FortiAPs will connect themselves wirelessly to the WiFi Controller through the mesh network. You must authorize each unit.

  1. On the FortiGate unit, go to WiFi & Switch Controller > Managed FortiAPs. Periodically select Refresh until the FortiAP unit is listed. This can take up to three minutes.

    The State of the FortiAP unit should be Waiting for Authorization.

  2. Right-click the FortiAP entry and choose your profile from the Assign Profile submenu.
  3. Right-click the FortiAP entry and select Authorize.

    Initially, the State of the FortiAP unit is Offline. Periodically click Refresh to update the status. Within about two minutes, the state changes to Online.

Creating security policies

To permit traffic to flow from the end-user WiFi network to the network interfaces for the Internet and other networks, you need to create security policies and enable NAT.

Viewing the status of the mesh network

On the FortiGate unit, go to WiFi & Switch Controller > Managed FortiAPs to view the list of APs.

The Connected Via column lists the IP address of each FortiAP and uses icons to show whether the FortiAP is connected by Ethernet or mesh.

Ethernet

Mesh

To see how the FortiGate wireless controller connects to the FortiAP, mouse over the Connected Via information.