Everything Instant On

 View Only
  • 1.  Help with isolating a WiFi network

    Posted 29 days ago

    I have a unique case.  I have a AIO 1930 switch, 5 AP22 APs and 1 AP27 AP and use the cloud portal for configuration and monitoring.  This network is sitting behind a Fortigate Firewall.  I need to configure a special wireless network specific for solar panel arrays to connect to, and then allow access through my firewall for our solar vendor to access these panel arrays.  I don't want them to have any other access other than to jus the arrays that are connected to a WiFi network, only on the AP27.  I was thinking of the following, but don't know how to implement it, and I need help.

    My main network is 10.35.0.0/24 on interface 1 (port 1) on the Fortigate which is connected to Port 24 on my 1930.  My 1930 has one wired network called "ESNC" and one wireless network called "ESNC_WiFI" on this IP range.  DHCP is handled by the Fortigate.  I was thinking to create a new VLAN on my Fortigate called "Solar" and assign it to Port 2 on the Fortigate, with a IP network of 10.35.10.0/24.  Then creating a VLAN on the 1930 called "Solar", assigning the AP27 device to that VLAN with a wireless network called "SolarWiFi"  Connect the solar arrays to that WiFi network and connecting the 1930 VLAN to the Fortigate VLAN.  Allowing VPN connectivity through my Fortigate to the 10.35.10.0 network only so that the vendor can VPN in and see only the solar VLAN and the solar arrays.  They cannot see ESNC or any other networks or devices on my larger network.

    How do I create the necessary VLANs, configure the AP27, etc. to make this all work?  Any help or guidance would be greatly appreciated.



    ------------------------------
    John Heimann
    ------------------------------


  • 2.  RE: Help with isolating a WiFi network

    Posted 29 days ago

    Create you new LAN on the fortigate Port 2 I would use the fortigate as the DHCP server.

    Set up DNS Server on FG or make sure you allow outbound DNS in the firewall policy

    Set any other outbound policies you need

     

    On the Instant On side you would create a new Wired Network/Employee Network called ESNC and assign it to a new VLAN ID

    Reopen the Wired Network option and select Network Assignment. 

    Select the correct Switch if you have nore than 1

    Select Remove all then select one port and set it to U for untagged.

    Patch that port to the Fortigate Port 2

     

    Create a new Wireless Network /Employee Network called ESNC. 

    For IP Assignment "same as a local network" select the ESNC the wired ESNC network

     

    You should be good to go.