Wireless Mesh Gotcha

FortiAP wireless access points have the ability to create a full mesh. This is a pretty nifty feature as described in the FortiOS Wireless Deployment Guide:

The access points of a WiFi network are usually connected to the WiFi controller through Ethernet wiring. A wireless mesh eliminates the need for Ethernet wiring by connecting WiFi access points to the controller by radio. This is useful where installation of Ethernet wiring is impractical. 

The AP that is connected to the network by Ethernet is called the Mesh Root node. It is configured with an SSID (also called a virtual access point or VAP) dedicated to backhaul communication with the remote FortiAP units. The backhaul SSID carries CAPWAP discovery, configuration, and other communications that would usually be carried on an Ethernet connection. Regular WiFi clients cannot connect to the backhaul SSID. They connect to the regular SSIDs carried on the access points.
The root node can be a FortiAP unit or the built-in AP of a FortiWiFi unit. APs that serve only regular WiFi clients are called Leaf nodes. Leaf APs that also carry the mesh SSID for more distant Leaf nodes are called Leaf/branch nodes.

In other words you can have the APs all wirelessly connected to each other and APs that are not wired into the network can backhaul their traffic via other APs. The requirement is that at least one of the APs in the chain is hard-wired to the network.

A small gotcha is that by default the wireless mesh uses its own internal IP addressing scheme. The default IP address for the full-mesh interface is 192.168.3.99/24. I found this out the hard way because I have a VPN tunnel to a remote network which also uses 192.168.3.x/24. Looking at the routing table it was easy to see why I could no longer reach the remote VPN network after I had setup my new wireless access points.

FGT # get router info routing-table database
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
       O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       > - selected route, * - FIB route, p - stale info

S    *> 0.0.0.0/0 [5/0] via 1.2.3.4, wan1
C    *> 10.1.1.0/24 is directly connected, Internal
S    * 192.168.3.0/24 [1/0] is directly connected, FW_VPN_2_0
C    *> 192.168.3.0/24 is directly connected, wl.mesh

There are two routes available in the routing database to 192.168.3.0/24, the ">" in front of the route shows which one has been selected as the active route. Simply changing the network of the mesh interface to something like 192.168.254.99/24 will resolve the issue. This can be done in the GUI via "System -> Network -> Interfaces"

Backing up the entire config with VDOMs enabled

When you have Virtual Domains (VDOMs) enabled on a Fortigate and you want to create a backup from the command line make sure you use the following command:

#config global
#exec backup full-configuration


Using "exec backup config" will only backup your current context, i.e. Global or the current VDOM.

Enhanced Single Sign-On to Windows AD in FortiOS 5.0

FortiOS 5.0 brings with it an enhancement to how single sign-on can be performed in a Microsoft Active Directory environment.

In prior versions of FortiOS an agent software was needed on either a Domain Controller or a Member Server. There was a lot of push back since many IT admins were not comfortable running third-party software on their critical AD servers. FortiOS 5.0 allows the firewalls to directly query the AD global catalog and event logs, the agents are now optional.

When a Windows AD user logs on at a workstation in a monitored domain, the FortiGate unit:

• detects the logon event in the domain controller’s event log and records the workstation name, domain, and user
• resolves the workstation name to an IP address
• uses the domain controller’s LDAP server to determine which groups the user belongs to
• creates one or more log entries on the FortiGate unit for this logon event as appropriate

When the user tries to access network resources, the FortiGate unit selects the appropriate security policy for the destination. The selection consists of matching the FSSO group or groups the user belongs to with the security policy or policies that match that group. If the user belongs to one of the permitted user groups associated with that policy, the connection is allowed. Otherwise the connection is denied.

(From the FortiOS 5.0 Authentication Guide)

Software Updates

Here's the latest and greatest.

 FortiOS: 4.0 MR3 Patch 12, Build 656 (Just released)
(stable, recommended for production)

FortiOS: 5.0.1, Build 147
(recommended for limited deployment in production if you need cutting edge features)