Discovering and authorizing APs
After you prepare your FortiGate, you can connect your APs to discover them using the discovery methods described earlier. To prepare the FortiGate, you need to l Configure the network interface to which the AP will connect. l Configure DHCP service on the interface to which the AP will connect. l Optionally, preauthorize FortiAP units. They will begin to function when connected. l Connect the AP units and let the FortiGate unit discover them. l Enable each discovered AP and configure it or assign it to an AP profile.
Configuring the network interface for the AP unit
The interface to which you connect your wireless access point needs an IP address. No administrative access, DNS Query service or authentication should be enabled.
To configure the interface for the AP unit – web-based manager
- Go to Network > Interfaces and edit the interface to which the AP unit connects.
- Set Addressing Mode to Dedicate to Extension Device.
- Enter the IP address and netmask to use.
This FortiGate unit automatically configures a DHCP server on the interface that will assign the remaining higher addresses up to .254 to FortiAP units. For example, if the IP address is 10.10.1.100, the FortiAP units will be assigned 10.10.1.101 to 10.10.1.254. To maximize the available addresses, use the .1 address for the interface:
10.10.1.1, for example.
- Select OK.
To configure the interface for the AP unit – CLI
In the CLI, you must configure the interface IP address and DHCP server separately.
config system interface edit port3 set mode static
set ip 10.10.70.1 255.255.255.0
end
config system dhcp server edit 0 set interface “dmz” config ip-range edit 1 set end-ip 10.10.70.254 set start-ip 10.10.70.2
end
set netmask 255.255.255.0 set vci-match enable set vci-string “FortiAP”
end
The optional vci-match and vci-string fields ensure that the DHCP server will provide IP addresses only to FortiAP units.
Pre-authorizing a FortiAP unit
If you enter the FortiAP unit information in advance, it is authorized and will begin to function when it is connected.
To pre-authorize a FortiAP unit
- Go to WiFi & Switch Controller > Managed FortiAPs and select Create New.
On some models the WiFi Controller menu is called WiFi & Switch Controller.
- Enter the Serial Number of the FortiAP unit.
- Configure the Wireless Settings as required.
- Select OK.
Enabling and configuring a discovered AP
Within two minutes of connecting the AP unit to the FortiGate unit, the discovered unit should be listed on WiFi Controller > Managed FortiAPs page. After you select the unit, you can authorize, edit or delete it.
Discovered access point unit
When you authorize (enable) a FortiAP unit, it is configured by default to use the default FortiAP profile (determined by model). You can create and select a different profile if needed. The FortiAP profile defines the entire configuration for the AP.
To add and configure the discovered AP unit – web-based manager
- Go to WiFi & Switch Controller > Managed FortiAPs.
This configuration also applies to local WiFi radio on FortiWiFi models.
- Select the FortiAP unit from the list and edit it.
- Optionally, enter a Name. Otherwise, the unit will be identified by serial number.
- Select Authorize.
- Select a FortiAP Profile.
- Select OK.
The physical access point is now added to the system. If the rest of the configuration is complete, it should be possible to connect to the wireless network through the AP.
To add the discovered AP unit – CLI
First get a list of the discovered access point unit serial numbers:
get wireless-controller wtp
Add a discovered unit and associate it with AP-profile1, for example:
config wireless-controller wtp edit FAP22A3U10600118 set admin enable set wtp-profile AP-profile1
end
To view the status of the added AP unit
config wireless-controller wtp edit FAP22A3U10600118
get
The join-time field should show a time, not “N/A”. See the preceding web-based manager procedure for more information.
Disable automatic discovery of unknown FortiAPs
By default, the FortiGate adds newly discovered FortiAPs to the Managed FortiAPs list, awaiting the administrator’s authorization. Optionally, you can disable this automatic registration function to avoid adding unknown FortiAPs. A FortiAP will be registered and listed only if its serial number has already been added manually to the Managed FortiAPs list. AP registration is configured on each interface.
To disable automatic discovery and registration, enter the following command:
config system interface edit port15 set ap-discover disable
end
Automatic authorization of extension devices
To simplify adding FortiAP or FortiSwitch devices to your network, you can enable automatic authorization of devices as they are connected, instead of authorizing each one individually.
This feature is only configurable in the CLI.
To enable automatic authorization on all dedicated interfaces
config system global set auto-auth-extension-device enable
end
To enable automatic authorization per-interface
config system interface edit <port> set auto-auth-extension-device enable
end