FortiOS Handbook - Deploying Wireless Networks

Dynamic user VLAN assignment
Configuring a WiFi LAN
Name
Interface
A name for the VLAN interface, such as VLAN100.
The physical interface associated with the VLAN interface.
VLAN ID The numeric VLAN ID, for example 100.
Addressing mode
DHCP Server
Select Manual and enter the IP address / Network Mask for the virtual
interface.
Enable and then select Create New to create an address range.
3. Select OK.
4. Repeat the preceding steps to create other VLANs as needed.
Security policies determine which VLANs can communicate with which other interfaces. These are the simple
Firewall Address policy without authentication. Users are assigned to the appropriate VLAN when they
authenticate.
To connect and authorize the FortiAP unit
1. Connect the FortiAP unit to the FortiGate unit.
2. Go to WiFi & Switch Controller > Managed FortiAPs.
3. When the FortiAP unit is listed, double-click the entry to edit it.
4. In FortiAP Profile, select the FortiAP Profile that you created.
5. Select Authorize.
6. Select OK.
VLAN assignment by VLAN pool
In an SSID, you can define a VLAN pool. As clients associate to an AP, they are assigned to a VLAN. A VLAN pool
can
• assign a specific VLAN based on the AP's FortiAP Group, usually for network configuration reasons, or
• assign one of several available VLANs for network load balancing purposes (tunnel mode SSIDs only)
To assign a VLAN by FortiAP Group - CLI
In this example, VLAN 101, 102, or 103 is assigned depending on the AP's FortiAP Group.
config wireless-controller vap
edit wlan
set vlan-pooling wtp-group
config vlan-pool
edit 101
set wtp-group wtpgrp1
next
edit 102
set wtp-group wtpgrp2
next
edit 101
set wtp-group wtpgrp3
end
end
end
44 Deploying Wireless Networks for FortiOS 5.4
Fortinet Technologies Inc.