FortiAP local bridging (Private Cloud-Managed AP)

Chapter 6 Deploying Wireless Networks for FortiOS 5.0 : WiFi-Ethernet Bridge Operation : FortiAP local bridging (Private Cloud-Managed AP)

A FortiAP unit can provide WiFi access to a LAN, even when the wireless controller is located remotely. This configuration is useful for the following situations:

• Installations where the WiFI controller is remote and most of the traffic is local or uses the local Internet gateway

• Wireless-PCI compliance with remote WiFi controller

• Telecommuting, where the FortiAP unit has the WiFi controller IP address pre-configured and broadcasts the office SSID in the user’s home or hotel room. In this case, data is sent in the wireless tunnel across the Internet to the office and you should enable encryption using DTLS.

Figure 169: Remotely-managed FortiAP providing WiFi access to local network

On the remote FortiGate wireless controller, the WiFi SSID is created with the Bridge with FortiAP Interface option selected. In this mode, no IP addresses are configured. The FortiAP unit’s WiFi and Ethernet interfaces behave as a switch. WiFi client devices obtain IP addresses from the same DHCP server as wired devices on the LAN.

There can be only one Bridge mode SSID per FortiAP unit.


	The Local Bridge feature cannot be used in conjunction with Wireless Mesh features. Block-Intra-SSID Traffic is not available in Bridge mode.

To configure a FortiAP local bridge - web-based manager

1. Go to WiFi Controller > WiFi Network > SSID and select Create New.

2. Enter:


Interface name	A name for the new WiFi interface.
Traffic Mode	Local bridge with FortiAP's Interface
SSID	The SSID visible to users.
Security Mode Data Encryption Preshared Key	Configure security as you would for a regular WiFi network.

3. Select OK.

4. Go to WiFi Controller > Managed Access Points > Managed FortiAP, select the FortiAP unit for editing.

5. Authorize the FortiAP unit.

6. The FortiAP unit can carry regular SSIDs in addition to the Bridge SSID.

Figure 170: SSID configured for Local Bridge operation

To configure a FortiAP local bridge - CLI

This example creates a WiFi interface “branchbridge” with SSID “LANbridge” using WPA-Personal security, passphrase “Fortinet1”.

config wireless-controller vap

edit "branchbridge"

set vdom "root"

set ssid "LANbridge"

set local-bridging enable

set security wpa-personal

set passphrase "Fortinet1"

end

config wireless-controller wtp

edit FAP22B3U11005354

set admin enable

set vaps "branchbridge"

end