Wireless Mesh

The access points of a WiFi network are usually connected to the WiFi controller through Ethernet wiring. A wireless mesh eliminates the need for Ethernet wiring by connecting WiFi access points to the controller by radio. This is useful where installation of Ethernet wiring is impractical.

Overview of Wireless Mesh Configuring a meshed WiFi network Configuring a point-to-point bridge

 

Overview of Wireless Mesh

The figure below shows a wireless mesh topology.

A wireless mesh is a multiple AP network in which only one FortiAP unit is connected to the wired network. The other FortiAPs communicate with the controller over a separate backhaul SSID that is not available to regular WiFi clients. The AP that is connected to the network by Ethernet is called the Mesh Root node. The backhaul SSID carries CAPWAP discovery, configuration, and other communications that would usually be carried on an Ethernet connection.

The root node can be a FortiAP unit or the built-in AP of a FortiWiFi unit. APs that serve regular WiFi clients are called Leaf nodes. Leaf APs also carry the mesh SSID for more distant leaf nodes. A leaf node can connect to the mesh SSID directly from the root node or from any of the other leaf nodes. This provides redundancy in case of an AP failure.

All access points in a wireless mesh configuration must have at least one of their radios configured to provide mesh backhaul communication. As with wired APs, when mesh APs start up they can be discovered by a FortiGate or FortiWiFi unit WiFi controller and authorized to join the network.

The backhaul SSID delivers the best performance when it is carried on a dedicated radio. On a two-radio FortiAP unit, for example, the 5GHz radio could carry only the backhaul SSID while the 2.4GHz radio carries one or more SSIDs that serve users. Background WiFi scanning is possible in this mode.

The backhaul SSID can also share the same radio with SSIDs that serve users. Performance is reduced because the backhaul and user traffic compete for the available bandwidth. Background WiFi scanning is not available in this mode. One advantage of this mode is that a two-radio AP can offer WiFi coverage on both bands.

 

Wireless mesh deployment modes

There are two common wireless mesh deployment modes:

 

Wireless Mesh         Access points are wirelessly connected to a FortiGate or FortiWiFi unit WiFi controller.

WiFi users connect to wireless SSIDs in the same way as on non-mesh WiFi networks.

Wireless bridging

Two LAN segments are connected together over a wireless link (the backhaul SSID). On the leaf AP, the Ethernet connection can be used to provide a wired network. Both WiFi and wired users on the leaf AP are connected to the LAN segment to which the root AP is connected.

 

Firmware requirements

All FortiAP units that will be part of the wireless mesh network must be upgraded to FAP firmware version 5.0 build 003. FortiAP-222B units must have their BIOS upgraded to version 400012. The FortiWiFi or FortiGate unit used as the WiFi controller must be running FortiOS 5.0.

 

Types of wireless mesh

A WiFi mesh can provide access to widely-distributed clients. The root mesh AP which is directly connected to then WiFi controller can be either a FortiAP unit or the built-in AP of a FortiWiFi unit that is also the WiFi controller.

 

FortiAP units used as both mesh root AP and leaf AP

 

FortiWiFi unit as root mesh AP with FortiAP units as leaf APs

An alternate use of the wireless mesh functionality is as a point-to-point relay. Both wired and WiFi users on the leaf AP side are connected to the LAN segment on the root mesh side.

 

Point–to–point wireless mesh

2.4GHz

FortiGate Unit

�,MeshSSID

,,, SGHz

Wired clients

Configuring a meshed WiFi network

You need to:

• Create the mesh root SSID.
• Create the FortiAP profile.
• Configure mesh leaf AP units.
• Configure the mesh root AP, either a FortiWiFi unit’s Local Radio or a FortiAP unit.
• Authorize the mesh branch/leaf units when they connect to the WiFi Controller.
• Create security policies.

This section assumes that the end-user SSIDs already exist.

 

Creating the mesh root SSID

The mesh route SSID is the radio backhaul that conveys the user SSID traffic to the leaf FortiAPs.

 

To configure the mesh root SSID

1. Go to WiFi & Switch Controller > SSID and select Create New > SSID.

2. Enter a Name for the WiFi interface.

3. In Traffic Mode, select Mesh Downlink.

4. Enter the SSID.

5. Set Security Mode to WPA2 Personal and enter the Pre–shared key.

Remember the key, you need to enter it into the configurations of the leaf FortiAPs.

6. Select OK.

 

Creating the FortiAP profile

Create a FortiAP profile for the meshed FortiAPs. If more than one FortiAP model is involved, you need to create a profile for each model. Typically, the profile is configured so that Radio 1 (5GHz) carries the mesh backhaul SSID while Radio 2 (2.4GHz) carries the SSIDs to which users connect.

The radio that carries the backhaul traffic must not carry other SSIDs. Use the Select SSIDs option and choose only the backhaul SSID. Similarly, the radio that carries user SSIDs, should not carry the backhaul. Use the Select SSIDs option and choose the networks that you want to provide.

For more information, see Configuring a WiFi LAN on page 828.

 

Configuring the mesh root FortiAP

The mesh root AP can be either a FortiWiFi unit’s built-in AP or a FortiAP unit.

 

To enable a FortiWiFi unit’s Local Radio as mesh root – web-based manager

1. Go to WiFi Controller > Local WiFi Radio.

2. Select Enable WiFi Radio.

3. In SSID, select Select SSIDs, then select the mesh root SSID.

4. Optionally, adjust TX Power or select Auto Tx Power Control.

5. Select Apply.

 

In a network with multiple wireless controllers, make sure that each mesh root has a unique SSID. Other controllers using the same mesh root SSID might be detected as fake or rogue APs. Go to WiFi & Switch Controller > SSID to change the SSID.

 

To configure a network interface for the mesh root FortiAP unit

1. On the FortiGate unit, go to Network > Interfaces.

2. Select the interface where you will connect the FortiAP unit, and edit it.

3. Make sure that Role is LAN.

4. In Addressing mode, select Dedicated to Extension Device.

5. In IP/Network Mask, enter an IP address and netmask for the interface.

DHCP will provide addresses to connected devices. To maximize the number of available addresses, the interface address should end with 1, for example 192.168.10.1.

6. Select OK.

At this point you can connect the mesh root FortiAP, as described next. If you are going to configure leaf FortiAPs through the wireless controller (see “Configuring a meshed WiFi network” on page 873), it would be convenient to leave connecting the root unit for later.

 

To enable the root FortiAP unit

1. Connect the root FortiAP unit’s Ethernet port to the FortiGate network interface that you configured for it.

2. Go to WiFi & Switch Controller > Managed FortiAPs.

If the root FortiAP unit is not listed, wait 15 seconds and select Refresh. Repeat if necessary. If the unit is still missing after a minute or two, power cycle the root FortiAP unit and try again.

3. Right-click the FortiAP entry and choose your profile from the Assign Profile submenu.

4. Right-click the FortiAP entry and select Authorize.

Initially, the State of the FortiAP unit is Offline. Periodically click Refresh to update the status. Within about two minutes, the state changes to Online.

5. Select OK.

You might need to select Refresh a few times before the FortiAP shows as Online.

 

Configuring the leaf mesh FortiAPs

The FortiAP units that will serve as leaf nodes must be preconfigured. This involves changing the FortiAP unit internal configuration.You can do this by direct connection or through the FortiGate wireless controller.

 

Method 1: Direct connection to the FortiAP

1. Connect a computer to the FortiAP unit’s Ethernet port. Configure the computer’s IP as 192.168.1.3.

2. Telnet to 192.168.1.2. Login as admin. By default, no password is set.

3. Enter the following commands, substituting your own SSID and password (pre-shared key):

cfg	-a	MESH_AP_TYPE=1
cfg	-a	MESH_AP_SSID=fortinet.mesh.root
cfg	-a	MESH_AP_PASSWD=hardtoguess
cfg	-c

exit

4. Disconnect the computer.

5. Power down the FortiAP.

6. Repeat the preceding steps for each branch FortiAP.