Fortinet Wireless Design

0:07Hello and welcome. My name is Keith Barker. And in this set of videos, you and I get to focus our attention on wireless network design. Because in a very small network, like a small office space, one or two access points put on the ceiling, and away we go, and it probably work just fine. But in a larger environment, like a large floor or multiple floors of a building, we need to really take some additional steps, including doing some site surveys and doing some estimates and testing to verify that we had the right gear in place. So in this set of videos, we'll take a look at some tools to do exactly that.

0:38And some tools, once we have our network set up, that we can use to help monitor and maintain those networks as well. So join me in the next video. We'll do a big overview and then we'll walk through the video step-by-step. I'll see you, my friend, in the very next video.

0:00[MUSIC PLAYING] In this video, you and I get to take a big picture look in the world of designing a Wireless Local Area Network. And one of the first steps is going to be planning. And that's going to involve asking a bunch of questions. For example, how many square feet are we trying to cover? Or how many users are we trying to support? Because it's going to be very different for implementing Wi-Fi services, for example, in a baseball stadium, or a huge environment like that, or a school, compared to a small office, home office.

0:31So regarding what, that would include what space are we trying to cover? What applications are the users trying to use on this wireless network? Because some applications are more sensitive to latency than others like voice over IP and other real time applications. Also in the planning stage, we'd want to ask when they expect this to be ready or when they need it. We'd also want to plan on whether or not we're going to include guest access as part of our wireless services. We also want to get our hands on some floor plans that we can use with our site survey tools, and also for our documentation regarding where the access points are going to be. And then when we have our data from our planning, our next step would be the site survey.

1:03And that's where we're going take our set of tools, which could include things such as the radio frequency analyzer or a spectrum analyzer. And quite often, we're going to put those on a cart and actually take that cart and walk it around the floor or walk around the building where we're going to be implementing the wireless. In that way, we can map out the space. And we can also do some testing with access points just to verify that the coverage we expect to have from one location is working as expected. And one of the tools for that from Fortinet is called FortiPlanner. And they've got a free light version and they also have a full blown version.

1:34And that can help with the mapping other tools include NetSpot. And there's other commercial tools as well we could use in combination with a laptop and a wireless network interface card as we do the site survey, and map out our plan for implementation of our access points. Also, doing the actual site survey in the walkthrough helps us identify objects that would impede signals, for example brick walls, or for that matter any walls. Or large objects like refrigerators, or generators, or other elements that might otherwise negatively impact signals in our Wi-Fi environment.

2:05Also as part of our site survey, we can identify where we want the signals not to go. So if we have a building like this and over here is the parking lot and we don't want signals to spill into the parking lot, we might put in some directional antennas here going this way. So inside the office we have the signals, but we don't have the signals over here. And then further in, we could use an omnidirectional antenna. So this would be a directional antenna over here, and then omnidirectional antenna's here for the major coverage. And then with our site survey done and our plan in place, we could then go ahead and implement the architecture, which in most environments are going to include a FortiGate acting as the controller which is connected to a switch stack.

2:39And there's inner switch links there. And then off of these switches with power over Ethernet, we're going to have our access points. So there's AP 1, and here we can have AP 2, and AP 3. And we also might want to name those access points based on where they physically are. And that way if we have the location integrated with the name, then when we see the name of an AP, we have an idea of exactly where it is. For example what building it is in, and what floor it's in, and what location on that floor it's in. And then once the wireless networks are set up and the SSIDs are in place with the security that we want, we then want to go ahead and do monitoring just to verify what's happening in the environment.

3:10And one of the tools that Fortinet offers for monitoring of our wireless network environments is called FortiPresence. And FortiPresence connect is a clearinghouse regarding what's going on for multiple locations. So we feel like 10 locations or 10 sites and you have Wi-Fi in each one of them, all that information can be fed into FortiPresence. And then with FortiPresence, it can give us a single pane of glass the ability to report on and dig through the data regarding what's happening in those wireless environments. So that's the big picture regarding Fortinet wireless design. And in the next video, I'd like to take a closer look at site surveys and many of the tools that we could leverage in mapping out and planning out our wireless networks.

3:44So I'll see you in that video in just a moment. Meanwhile, I hope this has been informative. And I'd like to thank you for viewing.

0:06One of the critical things to do when implementing a Wi-Fi network is to do a site survey. Now in preparation for that, we'd want to identify OK, what is the space we're trying to cover? What's the quantity, the density of devices that we're going to have supported with Wi-Fi? And then once we have that data, it would be important to have the tools ready to do a site survey and map out that space. And in performing a site survey, some of the tools we could use, one from Fortinet which is FortiPlanner, there are other commercial tools like NetSpot and others that can be used as well. And with both of these examples, you can run these applications on your computer, your laptop.

0:38It can be on the cart as you go around. And it can help you dynamically map out that space, with the intention of putting the correct number of access points, the right types of access points in the right locations to give appropriate coverage. So we might be intending to use the 2.4 gigahertz range, as well as the 5 gigahertz range. When I say 5 gig, I'm also referring to the possible six and a little bit of seven that are with the latest standards. And one of the things about Wi-Fi is that Wi-Fi signals may not be the only things that are consuming that space. So in addition to planners for Wi-Fi, we also may want to use a Spectrum Analyzer, because the Spectrum Analyzer can just look at the raw frequencies in that space, even if they're not Wi-Fi related.

1:18And that can give us a better indication of other signals that just may be noise as far as that frequency space is concerned. So in this video, I thought it'd be fun to give you a peek at FortiPlanner, NetSpot, as well as a Spectrum Analyzer as an example of three tools that could be used as part of a site survey. So this is FortiPlanner Lite. Now currently, I'm using version 2.6.5, which is current as of this recording. And the Lite version is also referred to as demo mode. So some of the features, including real-time heat maps, are not available until you actually license it. But even in the demo mode, we can take a look at a sample file and still get a good idea of what it can do for us.

1:51So if we click here on Open Project, and I'm going to open the sample project that came with it. And so over the top, we have tabs. Here we have a tab for the floor plan. And when we're putting together the floor plan, there's an option for selecting the wall types. And that way, it can help identify based on the type of wall how much attenuation or degradation of a Wi-Fi signal will happen as it tries to go through that wall. So here in the sample, we're looking at building 1 and floor 1 on that building. There's a tab for the Wi-Fi Planner, which gives us the ability to grab an access point and then place it manually in our topology. When I say manually, I mean manually here within FortiPlanner.

2:23So if we wanted more detail regarding a specific type of access point, the fastest way to do that is just to go to doc.fortinet.com. And from here, we can click on FortiAP And as of March 31st of 2022, they just upgraded to 7.2. So if we click here on 7.0 as of this recording, here we have the hardware guide for access points that can help us identify what the features and functions are, as well as some concept and architecture guides for deploying access points. Also if you want to check to see whether or not the access point that we're working with is compatible with the FortOS on the FortiGate, we're using-- we can use the compatibility matrix right here.

3:01Let's go and open that up. So here in the FortiAP and FortOS compatibility matrix, currently behind me I've got a few of the FAP-221E. And here it's saying that we recommend that the FortiAP-W2 firmware be matched with the respective FortiOS version. Now, the current FortiOS version that I'm running is 7.2 because they just updated it, and they don't yet have a 7.2 for the FAP-221E. So it's good news that says other variations of FortiOS and FortiAP-W2 versions may technically work for the lower common feature set. So when in doubt, go right to the source up to docs.fortinet.com for the latest and greatest information regarding the product that you're currently working with from FortiNet.

3:38All right, let me go and minimize that. So because this is the light or the demo version, I don't have a tab here for site survey. I don't have a tab here for live services. So once again, it won't give you a full functionality without a license. But even with that limitation, one of the cool things we can do here is with this map that's been built out that specifies the walls and windows where everything is, we could go up here to auto placement, click on that Go button, and it will automatically place access points where it thinks they may be needed, which is pretty cool. Or if we want to manually place somewhere we can select the AP we want to place, and then place it here on the map.

4:09Then what we want to do is after we put those in place, we'd want to go back and test it and verify that we have the appropriate coverage everywhere we expect to with the access points in place. Another example of a tool that we could use is NetSpot. Let's bring that up now. So with NetSpot, which we've looked at in a previous video, it's a fantastic tool. It's from the perspective of the device that's running on. So this is currently running on a Windows computer. It has a wireless network interface card with radios that support the 2.4 gigahertz range and the 5 gigahertz range. And as a result, it can report on everything that it sees, including the SSIDs, the Service Set Identifier, which is effectively the wireless network name, and the respective basic service set identifiers that are being advertised by the access points.

4:51Then it's showing the relative signal strength and the band, 5 or 2.4 gigahertz. Then the channel or channels being used. The channel width, the vendor, and that's based on the basic service set identifier in those Mac addresses. And then the type of security that's being implemented. And then the mode, whether it's Wi-Fi 4, 5, or 6 or something really old to see if we have something really old here within the range of this computer. Oh, and I don't. Sometimes I'll get a G in here for like an old printer or something that's showing up. But this is a great tool that we could then use as part of our site survey. So we had an access point in place, we could then take the laptop with this software running and wheel it around as if that user was roaming just to verify the signal strength anywhere we want to test in that building.

5:31So the free version of NetSpot doesn't have a site survey capability, where it helps you build a map as you wheel this around. However, NetSpot has a very affordable low end cost if you want to license it. And if you do, you then get the option for these surveys. So here is an example survey that comes with it as a sample. So you start off with the blueprint of your space, and then you simply take this software running on a laptop. And then as you wheel this through the space, you can go ahead and pinpoint individual locations. In that way, you can build a map and color code it regarding signal strength.

6:02So down here, a dark blue is a very weak signal and the red would be a good strong signal. So in our wireless network, we want to make sure that everywhere we expect to have wireless coverage that we are somewhere other than aqua or blue, which represents a poor signal. And more towards the light green and yellow and red, which indicates a stronger signal. So again this is another tool that we could use as part of doing a site survey. So I think we have a couple of samples here. So we go to Survey and Open Sample. And let me go open up the home office and family space. I'll say no to any changes there.

6:33Oh, that's what I had open. Let me go ahead and open up the other sample, which is a single family house. There we go. And this is an example of somebody who's doing a site survey, and they look like they're 1/3 the way through. And by doing a site survey, we can verify that our access points are providing the appropriate coverage for our Wi-Fi network or our networks. Now if we go back to discover here in NetSpot. And let me go ahead and sort by level. And let me go ahead and turn everything on here. And let's bring up this graph. So here is the 2.4 gigahertz graph based on what's currently being seen by my network adapter on this computer.

7:05And it looks like we have a bunch of stuff over on one. We have a bunch of stuff with the center channel 6. It's like what the heck happened over here? There's nobody over here with a significantly strong signal with a center channel of 11. So another tool that we may want to bring to the table is a Spectrum Analyzer or an RF analyzer that can help us identify what frequencies are in use and how much. And just the-- I'm always interested in toys and tools. And I saw the other day on Amazon, they had one on sale. And in fact, let me show it to you. So this is it right here. So oh, I have 389.

7:35So it was under $500. I thought to myself, that's pretty amazing for a Spectrum Analyzer. So as a result, I bought it. So it's pretty cool, because this mobile has an internal battery also plugs into USB. So you can have graphs on your computer. So it's fantastic because you could actually walk around with this and look for what are the highest signals in a certain frequency range? So let me share with you what the output looks like on a computer. And that output would look something like this as a little USB cable. And so this is showing us real time regarding those frequencies in these channels, especially those frequencies what's currently in use.

8:09So this helps confirm what we're seeing down here. So from the computer perspective, it is saying yep I see these Wi-Fi networks with these center channels. And approximately these signal strengths. And here we can verify with the analyzer that's the case. So based on these two different inputs, I expect to see quite a bit of traffic over here in this range of frequencies with the center channel of one, which we do right here. And also I'd expect to see quite a bit here with the center channel frequency of channel 6. So NetSpot is showing us the APs, and which APs are using which frequencies. And the spectrum analysis tool is showing us the actual usage of those frequencies.

8:42So it looks like even though this access point here with the center channel of six has the strongest signal, it looks like the busiest as far as traffic being used is down here in the frequencies with a center channel of one. And that's based on what's being shown here live by the RF Explorer. That's the name of this Spectrum Analyzer. So using a combination of site survey tools and Spectrum Analyzers, it's going to help us get an accurate picture of how solid our coverage is, and also an idea regarding what channels we should be focusing towards and implementing our wireless networks.

9:14So if we are going to manually implement new access point in the 2.4 gigahertz range, we would want to target the center channel of 11, at least for this position right here in my Studio, because that's the one that currently is the most available. And then we can do the same technique for the 5 gigahertz range as well. So if we wanted to try this also for the 5 gigahertz range, we could go to the 5 gigahertz channels tab here, instead of NetSpot. So it looks like we have a whole bunch in this range and a few up here of the higher end. And then we could bring in the Spectrum Analyzer again to help verify that what it sees concurs with what's shown here, which it seems to agree.

9:50Let me go and make that bigger. Also the Spectrum Analyzer has a couple of different antennas, and I have the same ones on for the 2.4 and the 5 gigahertz testing. So using a collection of tools, including site survey tools such as FortPlanner and NetSpot and others, as well as radio frequency spectrum analyzers are going to be helpful in planning out and building a successful wireless local area network. So thanks for joining me in this video. In the next video, we'll take a look at the Fortinet wireless components we're going to use as part of our wireless network. So I'll see you there in just a moment. Meanwhile, I hope this has been informative, and I'd like to thank you for viewing.

0:07And welcome back. In this video, we're going to take a closer look at the components from Fortinet that we're going to use it as part of our wireless networks. And I thought to myself, let's bring back our big design that we took a look at a few sets of videos ago, because that will serve us here as well. And let's start off with our access points. We're going to have at least one access point, maybe more. In my lab here, I think I have four or five that we can play with. And depending on the type of access point you have, that's going to control how many radios it has, what standards it supports, and what security features it supports. And for more details on the specific access point, just go to the documentation, and it'll specify what those access points are capable of.

0:42So regardless of type of access point, one thing all access points need is they're going to need power. So in our topology, we're going to use a switch that has power over Ethernet, delivering power over to these access points. And as we discussed in our previous video, we're going to use VLAN 2 with these ports here associated with VLAN 2, and that will be the VLAN dedicated for the management and working with our access points. So the access points are connected to switch, who's doing the power over Ethernet. They're in VLAN 2. The switch has interswitch links between switch 2 and switch 1. And switch 1 has two ethernet connections going up to the FortiGate.

1:14So from the switch's perspective, this would be the FortiLink trunk. And from the FortiGate perspective, this would be the FortiLink interface going down to switch 1. And the benefit of that is we can then use the FortiGate as the controller to configure and work with and manage our access points. And the default mode for setting up SSIDs in Fortinet with our access points is to use tunnel mode, which effectively creates a logical tunnel between the FortiGate and the access point. And it is a CAPWAP tunnel. And that allows us to go ahead and create, for example, SSID 30 and SSID 40.

1:46Clients can connect to those wireless networks. And the traffic from those clients going through the AP is sent through the CAPWAP tunnel up to the FortiGate. And with that CAPWAP logical tunnel in place between the access points and the FortiGate, then, as clients connect to, for example, SSID 30-- which is the 10.30 network-- or SSID 40-- which is going to be the 10.40 network, once we create those-- those clients exist on those networks and not on VLAN 2. Even though the access point that supporting those wireless networks is directly connected to a port with the native VLAN of VLAN 2. So the tunneling between the access point and the FortiGate makes that possible.

2:18And regarding the access points, they could be standalone external access points like these are, or they could be access points that are integrated as part of a FortiGate firewall. And when the access point is integrated as part of the FortiGate, they call that FortiWiFi. And so with FortiWiFi, of course, we're going to manage the Wi-Fi built into the FortiGate via the FortiGate. And with these external APs, we're also going to manage them using the FortiGate as the controller. There also is the option of doing cloud management of our wireless environments with FortiAP. and. That was the old name for it. And that was called FortiLAN Cloud.

2:48And with FortiLAN Cloud, that's a cloud-based web service that can support access points as well as switches. So you log on to cloud services to go ahead and manage them, as opposed to logging onto them directly. Now, because we have most of this infrastructure in place-- we have the FortiGate, we have the switches-- in the next video, I'd like to go ahead and take one access point and plug it into port number 1 here on switch number 2 and just verify that it can be discovered. We'll also take a look at some methods that are used between the FortiGate and the access point to allow the access point to be managed by the FortiGate.

3:19So we'll do that in the very next video. So I'll see you there in just a moment. Meanwhile, I hope this has been informative, and I'd like to thank you for viewing.

0:06In this video, we're going to add an access point to the mix. We're going to take our existing infrastructure from a few sets of videos ago and then plug in one access point to make sure it comes up. So let's first start off by verifying we can log in to our FortiGate. Also, I'll verify our switches are in place. Let's make sure that these ports here on switch 2, the first five ports, are associated with VLAN 2. And then we'll plug our access point into the first port. All right, so here we go. We are at firewall 1, firmware 7.2. It says we're unable to connect to FortiGuard servers, and that is because it's been up for just a few minutes and it hasn't had a chance yet to fully initialize and get out there and get updated.

0:41So we'll give it a few minutes before we start worrying about that. And then right here, it shows us that we have two connected FortiSwitches, which is a good sign. And there they are, switch number 1 and switch number 2. And those are off of the FortiLink interface. So if we go down to Wi-Fi and Switch Controller and we go to the FortiLink interface, those switches are connected over the FortiLink interface. And so they should have the IP addresses in the 10.1.0 address space. So if we go down to Manage FortiSwitches, here indeed they are. They're switch number 1 and switch number 2. Go over here and click on List and go down to the topology view.

1:11We can verify how they're connected. So what we want to do is go down to FortiSwitch VLANs. And here is VLAN 10 and VLAN 20, which we're using for users. And here is VLAN 2 that we're going to use for our access points. So on switch number 2, we want to make sure that the native VLAN on part 1 is associated with VLAN 2. So if we go one below here on the left down to the FortiSwitch ports and we expand switch 2, the little lightning bolts represent power over ethernet. That's a great sign. So we can supply power to our access points. And let's configure port 1, 2, 3, and we'll go all the way through 5.

1:43And we'll associate all of those with VLAN 2. So I'll go ahead and just select those five by clicking on port 1, holding down the Shift key, clicking on port 5. Then over here, I'm going to click on edit the native VLAN, and we'll specify we want that to be VLAN 2. And click on Apply. And bada-bing, bada-boom, we're done. So all those five ports, the first five ports on switch 2, are associated with VLAN 2. So we'll go ahead and minimize that. And next, we'll go under Wi-Fi and Switch Controller and click here on Managed FortiAPs. So currently, there aren't any. That's great.

2:14However, when they do show up, they should be assigned IP addresses from the VLAN 2 address range. So if we go back down to FortiSwitch VLANs and we look at the details for VLAN 2, it should be on the 10.2.0 subnet. And the DHCP services start at 101. Oh, I'm also glad we looked at this. We also want to enable the security fabric connection on this interface that is supporting those access points. So this is the logical VLAN 2 interface on the FortiGate. And again, we want to make sure we're supporting the security fabric connection on that interface.

2:44All right, that looks good. So we'll click on OK. And let's go back to the Managed FortiAPs. And I'm going to go back to the rack. And I'm going to plug in the first access point to port number 1 on switch number 2. All right, it is plugged in. So that may take a moment to come up. So while we're waiting for that, let's go back down to FortiSwitch ports. And we can verify that the link is up. Ah, fantastic, it is. There's port 1, a little green indicator. Also delivering 1.9 watts of power at the moment, which implies that that access point is getting power. Also, if we right click on this port and we go down to Status and we disable it, it should be known that that does not stop the power over ethernet.

3:21It's still delivering power. So right here, hovering over this port that's down, it's still delivering power to that device. So if you want to stop the PoE as well, you could right click. And then from the drop down, go down to PoE and say Disable. So I'm going to go ahead and I'm going to leave PoE enabled. And I'm going to go back to status and enable the port. All right. We also have the ability, if we wanted to right here, just to reset PoE. That's effectively bouncing that device by removing power and resupplying power on that port. Also, it looks like I've got a warning message. Unable to connect to FortiGuard servers still.

3:51hmm. Let's just do a quick check real quick. And I'll do an execute ping out to www.fortinet.com. Oh, that works. All right. So we have internet connectivity. So it'll be a moment, and that will clear itself up, regarding unreachable FortiGuard servers. Also, if you want to speed up that process a little bit, what we can do is go down to System and FortiGuard. And then down here, if we get down to filtering, I have often discovered that if you do a test connectivity, that will help wake it up. Or if we go up here, still under FortiGuard, and click here on Update Licenses and Definitions Now, that will also trigger some connectivity to the FortiGuard servers.

4:26All right, so let's go back to Wi-Fi and Switch Controller, back to Managed FortiAPs, and-- so it's not showing up at the moment. Let me do a refresh down here. So I'll give that a few more moments. And if it doesn't show up, we'll do some troubleshooting. But I think it's just going to take a moment for it to come up. So we'll do a refresh. So now after doing a refresh, I see here I've got this access point. And it shows me over here that I have one device that's requiring authorization. So we'll go ahead and right click on this access point. From the dropdown, we'll click here on Authorize. And boom, device successfully authorized.

4:56And let me go ahead and name that access point number 1. So we'll click on Edit and we'll name that AP-1. We'll come back to more of these details in a subsequent video. So we'll click here on OK. So here's the name AP-1. It shows it's offline. But that will also correct itself here in a moment or two once it fully initializes. If we scroll up to the right, it says there's no LLDP neighbors found at the moment. But that will also change once it gets fully initialized, because LLDP is running on the switch. It's also running on the access point. So the access point should be able to report that it is hanging off of port 1 on switch 2.

5:30Also, here it's showing us the VLAN it's currently connected to, which is our AP Management VLAN. It's also been assigned by default a FortiAP profile based on the hardware model it is. So it is a FAP221E. And if we hover over that, that'll reveal that based on the serial number, FP221E. And it assigned it a default profile based on that model of AP. So while that's getting fully initialized, let me go ahead and plug in another AP, which will be AP-2. And we'll plug it in on port number 2 on switch number 2. And just as a quick check, if we go down to FortiSwitch ports, port number 2, the native VLAN is VLAN 2.

6:04Perfect. Let me go ahead and plug right now a second AP into port number 2. All right, that is plugged in. So let me go ahead and do a refresh to this page. And sure enough, port 2 right here is now supplying power to that second access point. We can also click here on Faceplates and take a look at the icons here. And that also reflects as well. So here on switch 2, if we hover over those ports, it'll show us those details for port 1 and port 2. So let's go back to FortiAPs. And in a moment here, when it shows up, we'll authorize it as well. And actually, come to think of it, I'm going to go ahead and plug in all the APs.

6:35And then based on naming them, I can identify based on the LLDP information, once it shows up, which port they're connected to. And so we'll just name the access points based on the port. So AP-1 will be on port 1, AP-2 will be on port 2, and so forth. So let me plug in all the rest of the access points right now. So we'll have ports 1, 2, 3, 4, and 5 with five access points. So as these come up online, I'll go ahead and authorize them. And then once the LLDP information reports what port they're on, I'll go ahead and rename them appropriately. So I'm assuming this is going to be AP-2.

7:06In fact, I'm going to make an educated guess and say that it is, because I plugged it in second. So we'll call it AP-2. Click on OK. And the other three should be showing up here shortly as well. Now, while we wait for those other access points to show up, we also could have connected an access point directly to the FortiGate. Now, the challenge is on my little FortiGate, I have a little 60F. It doesn't have power over ethernet ports. And so as a result, if I want to plug it in directly to the FortiGate, I have to have an external power supply feeding into the access point for power. So for the benefit of not having to use an external transformer, I'm going to go ahead and use AP-1, 2, 3, 4, and 5, all plugged into ports here on switch 2, providing the power over ethernet.

7:46So back here, I have another one. So I'll right click on that one, authorize it. And I plug these in in order. So I'm assuming that's on port 3, so I'll right click there. And let me edit that and name it AP-3. Just like that. Click on OK. And also, looking at the LLDP information over here, so I got AP-2 correct. That's on port number 2. So as they come up, we'll authorize them individually, and then we'll name them appropriately based on the port they're connected to. All right. So there is 4 and 5. So I'll go ahead and right click and authorize each one of those. And then I'll go ahead and name them.

8:16So right click, Edit. And that'll be AP-4 and this one will be AP-5. So we'll name those guys. And I also want to verify here in a moment that the devices I named AP-4 and AP-5 really are in ports 4 and 5 respectively. All right, and they line up. So 1, 2, 3, 4, 5, on ports 1, 2, 3, 4, 5. Fantastic. They're all running the same version of firmware. If we needed to update one, we could right click on it. From the dropdown, select Upgrade. And if there was an update available via FortiGuard, we can choose it. Or we could browse for it if we downloaded it manually from Fortinet.

8:49So I just made a quick trip over to support.fortinet.com and looked at the latest version of firmware for the FortiAP. And I've got a 221E. And it is build 700, even though it's in a subfolder called 7.0.3 with build number 0060. And that is currently what I'm running right here. So my firmware is current on these APs, which is a great start. And you know what I'd like to do just as an exercise? Let's do this. I'm going to right click on AP number 5 and I'm going to go ahead and delete it and click on OK.

9:20And what I'd like to do as a demonstration is I'm going to take AP-5, or what was AP-5, and I'm going to connect it directly to one of the ethernet ports on the FortiGate. So if we go to Network and Interfaces on firewall 1 and we take a look at our interfaces for a moment-- now you open up the ones that are not being used. On this internal switch, it has 2, 3, 4, and 5. I'm going to go ahead and borrow port number 2 from there. So I'm going to go ahead and say, you know what, Mr. Logical Internal VLAN Switch, I'm not going to have you use interface 2. I'm going to remove that. And that way, part 2 can be available as a normal interface.

9:50So we'll go down to internal 2. And let's go ahead and call this for AP-5. And for the use, it's going to be LAN. And for its IP address, let's use 10.9.0.71 with a 24-bit mask. And let's enable PING and Security Fabric Connection. And we'll enable DHCP services. And we'll start at 101. And I'll set this really short lease of 300 for my lab environment. And that way, we can demonstrate using access points that are hanging off of a switch that's being managed by the FortiGate as well as a port directly connected to the FortiGate.

10:24And what I'll do is I'll use a little transformer to supply power. Because internal 2 does not do power over ethernet. And I'll also have it create a little address object for us as well, representing the 10.9 subnet. All right. So having done that, let me go ahead and click on OK. So I want to take this access point, which will be access point 5, plug it into port internal 2 on the FortiGate, and then use this transformer to supply power to this access point. All right, it is done. So if we go back down to Wi-Fi and Switch Controller, I have an access point that was waiting for authorization.

10:54That's the one we just pulled out. So I'll go ahead and delete that and click OK. And in a few moments, we should have an access point showing up off of our internal 2 interface, as opposed to coming in from VLAN 2. That should be then wanting to be authorized as well. On that way, we have examples of two different ways of connecting the access points and associating it with the FortiGate with the directly-connected access point or via the switches. So as we wait for that, let's go up to Dashboard and Network. And we'll click on the DHCP widget right here. And let's see if we have any IP addresses assigned out in the 10.9 range.

11:26And right there. All right. So there's our FortiAP. It has an IP address. Fantastic. And it shows the interface it's connected to. Great, great, great. So let's go back down to Wi-Fi and Switch Controller, back down to Managed FortiAPs. And in a moment, that access point should show up right here waiting for us to authorize it. All right, and there it is. So I'm going to right click on that and we'll edit it. And we'll call it AP-5 and click on OK. And we'll also authorize it, which is important. So now it's authorized. And once it's fully initialized, it should show the OS version, which should be the same as the others.

11:59And it should also show from an LLDP perspective that it is directly connected to firewall 1, as opposed to the individual ports on switch 2. So it's been a moment. I just did a refresh. Here it shows AP-5 online. If we scroll over to the right, it shows no LLDP neighbors found. However, I believe that will also correct itself here in a few seconds as well. And then here on the Connected Via, its connected via the port internal 2 directly on the firewall. So let me go ahead and do a refresh. And here now in the LLDP column, it's indicating it's connected directly to firewall 1.

12:29So while we're here and talking about access points, I also want to take a moment and chat with you about what to do when something goes terribly horribly wrong. Let's say, for example, access point 5 won't come online. We can't reach it. I mean, what do we do? A lot of these access points do not have a separate console port, so you can't actually get a console port and see what's going on at the CLI. So we need some mechanism for troubleshooting to get access to a device. Like, for example, this access point. And what Fortinet has given us with most of these access points is the ability to enter something that they call configuration mode.

13:01And here's how it works. On the access point, there is a little reset button. So you get a little pin and you put it in that hole and you push on it. And here's the secret about going into configuration mode-- we do not want to push it for a longer than 10 seconds. Because if we do, it's going to do a factory reset of that access point. Now, perhaps that's something we want to do. If so, great, 10 seconds will get you there. But what we also don't want to do is we don't want to hold that reset button down for less than five seconds. So the sweet spot is five to 10 seconds. We want to hold down that reset button, and that's what puts us into configuration mode.

13:34So this access point is going to generate its own SSID-- its own wireless network. And that wireless network name is going to be very obvious. It's going to show up as FAP for FortiAP dash config followed by the serial number of that FortiAP. And then what we can do is we can use our wireless network card on our management computer and connect to that wireless network, where DHCP services are active. So it's going to have the IP address of 192.168.100.1. And it will dynamically assign our computer and address from that subnet.

14:08So what I'd like to do right now is demonstrate that for you in action. So let's imagine that we're having some issue with access point 5. And I'm going to go over to access point 5 and I'm going to push down the reset button for probably around seven seconds. And I'm going to time it too, because if we go too long, if we go more than 10 seconds, we're going to do a reset. So if we just want to get config access to access point 5, we need to be in that sweet spot between five and 10 seconds. So I'll go ahead and do that right now. All right, so it is done. And I timed myself, seven seconds. That way I was at least five and less than 10, and wasn't going to do a reset on that access point.

14:41And let me bring up Control Panel on my computer. And I'm going to right click on my Wi-Fi adapter. In fact, before I do that, let me just see where I'm at with my ethernet right here. So I'll bring in a command prompt here. And let's just do a quick IP config. This is on a windows computer. So currently, my ethernet adapter has the IP address of 192.168.1.151 with a 24-bit mask. Great, great, great. And I have a wireless network card, but I'm not currently associated with any wireless network. So let's also do this. Let's bring up NetSpot and let's take a look and see when that network shows up.

15:12So I'm expecting here in a few minutes for that wireless network from that access point to be visible so I can join it. So I'll leave this running right here. And then over here on the Wi-Fi, I'll right click and say Connect/Disconnect. And then over on the other screen, I'm going to click on More Wi-Fi Settings. And this will give me the ability to join a wireless network right here. So I don't see it yet, but I will give it a few more moments to initialize and go into configuration mode. So I'm going to sort these based on signal strength. And I'm going to change my scan interval to every five seconds.

15:43And that way, when it appears, we should see it right away. And it is also going to have open authentication. So we could look for that as well. Over here at security, I could do a sort based on security. And look at that, it is right there. And it's showing right there, but it is grayed out. That means it was present for a short period of time and now it is gone. So let me do this. So I'm going to remove that access point from the firewall. I'm going to remove the cable and then hit the reset button for seven seconds again to go back into configuration mode. So it could be, because it's being managed by a FortiGate, perhaps it's not completely willing to go into config mode.

16:16So I'm going to go ahead and disconnect it from the firewall and then I'm going to hit reset again for seven seconds. All right, and there it is. So I've got options here in the 5 gigahertz range on channel 36 and also at the 2.4 gigahertz range on the center channel 6. It's also showing up here now as an available network that I can join. So I'll go ahead and click on that and say I want to go ahead and connect. There's no authentication required. It's open authentication. It says we're connected. Let's take a look at the CLI on my computer just to verify it.

16:46So just a moment ago, I had my local address of 192.168.1.151 on my ethernet adapter. And I should have now another IP address on my wireless adapter. So we'll do IP config again. And sure enough, there's my local area network ethernet wired connection. And here is the IP address I've been assigned by the access point. So now we can just open up HTTPS to that IP address, 192.168.100.1, which is the IP address of the AP itself. And we can manage it in config mode. And look at that.

17:17That IP address is also associated with my cable modem. So let me do this for the demonstration. I'm going to go here. I'm going to disable my ethernet adapter. And let me go ahead and try back at 100.1. And now we're at the FortiAP. That was just a terrible coincidence. All right, then we'll go ahead and log in. So we've set up a password on that access point. We'll go ahead and use that same password and click log in. And now we are logged in directly to that AP. So down at the bottom, it shows us that we're in config mode. And we need to reboot to exit configuration mode.

17:47So from here, we can verify the firmware version, the base MAC address, the radio information. So here's the 2.4 gigahertz range radio. And here's the 5 gigahertz range radio. And there's the SSIDs that it's currently offering on both of those. Then there's an option there for system status on the left, which can confirm any of those details for us. And if we select WTP Configuration, it has a section for CAPWAP session. So it was connected over to the FortiGate, and it got an IP address assigned to it as 10.9.0.101. And it's using that IP address for the CAPWAP tunnel up to the controller, or at least when I plug it back in, it will be.

18:22And then one below that, we have radio configuration. So radio 0 is the 2.4 gigahertz range. And the radio 1 is the 5 gigahertz range. And then under Settings, there's an option here for Local Configuration. So if we want to change the host name or the password or other details, we could, including the baud rate. So it's kind of funny, because the access point has absolutely no serial port. So the baud rate is irrelevant for this platform. But other access points have a console port, so that would be relevant there. We also have options regarding discovery type. So for the discovery type, which is the means by which this access point can find the FortiGate, it's set to auto.

18:57And it's going to try multiple different options to discover and connect up with the FortiGate controller. However, if you don't want to use the auto method, you can say static. And we could specify the IP address of the controller, or could say DHCP. And then provide under DHCP services option 138 specifying the IP address of the controller. Or we could do it via DNS, where we create a DNS entry behind this name that maps to the controller. Or use broadcast, which is one of the default methods, or multicast. And this is the default multicast address. So if you have multicast routing set up in your enterprise, this would be an option where the access point doesn't have to be on the same subnet as the controller, as the FortiGate.

19:35And as long as multicast routing is set up, this would act as a mechanism to allow the access point to find the controller. Or if we want to use FortiAP Cloud, we could click FortiAP Cloud, which is now known as FortiLAN Cloud, because it incorporates the switching and the apps. But in either case, we could specify that, and then putting information for the server. So by default, it's set to auto. If you don't need to change that, leave it as auto. And then option of broadcast, which is included as part of auto, is going to do the job for us, especially if we place the access point directly connected to the FortiGate to an interface there or to a switch port on a switch stack that the FortiGate is managing.

20:10All right, so if we needed to make some config changes here, we could do it here in config mode. And then once those are made, we just go up to admin here in the upper right. And from the dropdown, we just simply say reboot. And that's going to reboot this FortiAP with those changes that we modified in config mode. So I'm going to walk back over to the rack. I'm going to plug that 40 AP back into the firewall on internal 2. I'm also going to reconfigure my computer so that I have access to the network. So I'm going to enable my ethernet adapter. All right, that looks good. Now, in a few minutes, hopefully this AP-5-- let me refresh the screen.

20:42Hopefully, that's coming back, unless I made some change in config mode which would prevent that. And the other great thing about these devices is, because we're managing these apps from the FortiGate, we could actually reset this completely. Just hold down the reset button for a little longer than 10 seconds, do a factory reset, and then bring it back into the fold, and we'd be good to go. In fact, it's been about two or three minutes. I must have made a change that it didn't like while I was in config mode. So I'm going to do exactly that. I'm going to go ahead and just do a full reset on access point 5 and bring it right back in.

21:13Yeah. When I went over there, the LEDs for the radios for the 2.4 and the 5 gigahertz were on. And at the moment, they shouldn't be, because we don't have any SSIDs set up. So that implies that it was still in either config mode or acting on its own. So I just did a full reset. And it should be back here in the fold in just a moment. And one of the cool things we're going to discover as we continue our sets of videos together, by using FortiAP profiles-- so there's a profile that was created based on the platform by default they're all using. But we can modify this or we can create new AP profiles and assign them to access points that control and tell them how to behave.

21:49And that way, we can bring in dozens and dozens of APs, assign them to the profiles that are appropriate for what we want them to do. And that removes a lot of the work of having to individually configure access points to support the wireless local area network. So let's go back to Managed APs. And I'm going to remove this one just by saying delete and OK. And when it comes back, I'll just go ahead and reauthorize them and bring them back in. And there it is. So I'll go ahead and bring it back in. We'll authorize it. And we'll right click on there and we'll edit it. And we'll call this once again AP-5.

22:22And that should be fully online. And the LLDP information should reflect that here in just a moment as well. So now that we have most of our infrastructure in place, there's a few more steps that we need to take to get wireless network services up and running. Number one is we need to create Wi-Fi networks, which we're going to do by creating one or more SSIDs. And I'll walk that in a separate set of videos. However, before we leave this set of videos, I'd like to share with you one additional product from Fortinet that can help us with the big picture view of what's happening in our wireless space. So we'll do that next with a tool called FortiPresence.

22:53I'll see you there in just a moment. Meanwhile, I hope this has been informative and I'd like to thank you for viewing.

0:00[MUSIC PLAYING] And welcome back. A big part of wireless networks is to support the business, and part of that business may be to supply guest access for your customers. Maybe we go to a coffee shop or a restaurant, and there's free Wi-Fi or a hotel. There's free Wi-Fi. We love free Wi-Fi or at least, included Wi-Fi. That's part of the agreement that we're going to click on oftentimes when we say we're going to agree to the terms. It often includes the details that they can track where you're going, what you're doing, and they can take that data and sell it.

0:32Now, how did they go about collecting and gathering all that data? Well, one solution for the collection of that data regarding where people are going, where are they searching for, and so forth is use a product from Fortinet called FortiPresence. And in this video, I'd like to give you a presentation of what that looks like. So let's begin here, and this is just a PDF regarding FortiPresence. And it comes in a few flavors, we could have it hosted in the cloud as a cloud service or we could deploy it as a couple of virtual machines in our infrastructure. And here's the goal is to gaining insight and behaviors of visitors within their site, both in real time and across time period.

1:03So we click the data, have it sent over to for a FortiPresence, and then FortiPresence can generate reports and output showing us exactly what's going on, which could include trends, how many visitors were there, time spent at a location, comparison across areas, and so forth. And there's lots of applications for this in malls, stores, hospitals, hotels, theme parks, airports, et cetera. So all Wi-Fi enabled devices, if they're on Wi-Fi, are sending out signals. So at 40 AP or if you have Wi-Fi integrated as part of your FortiGate, which would be for the Wi-Fi, they capture the Mac address, the strength of the signal from that smartphone or from that device, that's forwarded over to for FortiPresence.

1:39And then FortiPresence can take all that data and help us build reports and make sense of it. And here's an example of some screens and reports that it could build. And as far as the analytics and what it can gather, it can include things such as total visitor traffic, how long they were there, repeat visits. And here's an example of what some of those analytics could be used for. So I thought to myself, self, you know what, I'd love to see this firsthand. So I have behind me a rack of Dell servers. So I went to the deployment guide, I downloaded the files required. I created two VMs, one for infrastructure, one for apps.

2:11Simply following these instructions, and I ended up deploying these two, which are the FortiPresence's infrastructure virtual machine, and then this one here is the FortiPresence app virtual machine. So once they were deployed, which is pretty easy just a few clicks, I then logged on with the default username and password. I verified with the IP addresses were with ifconfig at the CLI. And by default, they were both DHCP assigned addresses. And so I just left them at that. The infrastructure machine-- in fact, let's take a look real quick. This guy got the address of 192.168.1.21 in my lab environment.

2:41And the app's VM got the IP address of 192.168.1.22. So having to do this command as route, they locked out his route and log back in as user Presence with the password of Presence, I used a copy program to copy these two files over to their respective servers. And to use that, I, used a product that's integrated as part of secure CRT which is secure FX, which allowed me to very easily copy the files that downloaded from Fortinet over to those VMs. Then I follow the steps for extracting the files. I ran the scripts they asked me to run. As part of the setup, it asked me about the details regarding the infrastructure host and the app's host, those two VMs respectively.

3:16It asked me to create a new username which I did, and the password which I did, insert all the processes, and it was done. And then when I was done, I simply used HTTPS from a browser to log in to the application VM. And that looks something like this. So from here, you, can go to Admin and site management, and you can add buildings. So here, I just clicked on the building. And let's go ahead and put a building right here on-- how about right at Charleston, near the Arts District. Boom. So I basically moved the map around to represent Las Vegas, and you can just drop where you want the building to be.

3:46I'll go ahead and click on Save. And then for that building, you can add a floor, and have the blueprints regarding those floors. So this is on prem with local virtual machines, but it also can be integrated as part of your Fortinet account with cloud services. And then based on all the information that sent to FortiPresence, it can then generate reports for you visitor report, network report, site reports, device reports, et cetera. I mean, this is a great tool to help correlate and get a big picture view of what's happening in your wireless networks. So if we go back to the dashboard I've got two buildings, two sites, I've got one I did earlier.

4:18And currently, we don't have any details on what's going on because I don't have any access points currently supporting any active SSID's feeding into FortiPresence. So it's pretty tough to use a tool you're not aware of. So in this video, I want to make you aware of FortiPresence. And again, it's available either on prem or you can do it in cloud services from Fortinet. So in this set of videos, we focused on wireless network design and moving a step closer to actually implementing wireless networks, which by the way, is the topic of our next set of videos is actually implementing the wireless networks. And I'll see you there soon.

4:48Meanwhile, I hope this has been informative, and I'd like to thank you for viewing.