Setting up a WiFi Bridge with a FortiAP

In this example, you will set up a WiFi network with a FortiGate managing a FortiAP in Bridge mode.

You can configure a FortiAP unit in either Tunnel or Bridge mode. When a FortiAP is in Bridge mode, the Ethernet and WiFi interfaces are connected (or bridged), allowing wired and wireless networks to be on the same subnet. Tunnel mode is the default mode for a FortiAP. A FortiAP in Tunnel mode uses a wireless-only subnet for wireless traffic.

For information about using a FortiAP in Tunnel mode, see Setting up WiFi with a FortiAP.

_{Find this recipe for other FortiOS versions}
_{5.2 | 5.4 | 5.6}

1. Connecting and authorizing the FortiAP unit
Go to Network > Interfaces and edit the lan interface. Set Addressing Mode to Manual and set an IP/Network Mask. Under Administrative Access, enable CAPWAP and optionally enable PING to test your connection. Enable the DHCP Server. Under Networked Devices, enable both Device Detection and Active Scanning.
Connect the FortiAP to the lan interface.
Go to WiFi & Switch Controller > Managed FortiAPs. The FortiAP is listed. The device is not yet authorized, as indicated by the in the State column. By default, the FortiGate adds newly discovered FortiAPs to the Managed FortiAPs list but does not authorize them.
Right-click on the FortiAP, and select Authorize.
The device interface will be down initially, but after a few minutes, hit the Refresh button and a will confirm that the device is authorized.
Verify that your FortiAP is on the latest firmware. If the OS Version shows that a newer firmware version is available, check the release notes for your product.
You can download the firmware images from the Support Site to your Local Hard Disk, or you can select A new firmware version is available and download the latest version directly from FortiGuard.
2. Creating an SSID
Go to WiFi & Switch Controller > SSID and create a new SSID. Set Traffic Mode to AP Bridge, creating a local bridge with the FortiAP’s interface. Configure the WiFi Settings as you would for a regular wireless network and set a secure Pre-shared Key.
3. Creating a custom FortiAP profile
Go to WiFi & Switch Controller > FortiAP Profiles and create a new profile. Set Platform to the FortiAP model you are using (FAP221C). Select the Country/Region and you have the option change your AP Login Password. Under Radio 1, set the Mode to Access Point. Set SSID to use the new SSID profile (in the example, MyWiFi). Set Radio 2 to Disabled.
Go to WiFi & Switch Controller > Managed FortiAPs and right-click on the FortiAP. Select Assign Profile andset the FortiAP to use the new SSID profile (in the example, MyProfile).
4. Results
Connect to the SSID with a wireless device. After a connection is established, you can browse the Internet using the wireless network configured in this recipe.
On the policy list page, right-click on your lan to wan Internet access policy and click Show in FortiView.
Make sure to view the session details, including more information under the various tabs (Sources, Destination, Applications, Countries, Sessions).
Go to Log & Report > WiFi Events to see the detected client IP and authentication logs.
You can also go to Monitor > WiFi Client Monitor for user details and Monitor > WiFi Health Monitor for the AP Status.