Fortinet Wireless Starter Kit User manual

Wireless Starter Kit Guide
for FortiOS 4.0 MR2

Wireless Starter Kit Guide
23 February 2011
01-420-139115-20110223
for FortiOS 4.0 MR2
© Copyright 2011 Fortinet, Inc. All rights reserved. No part of this publication including text, examples,
diagrams or illustrations may be reproduced, transmitted, or translated in any form or by any means,
electronic, mechanical, manual, optical or otherwise, for any purpose, without prior written permission of
Fortinet, Inc.
Trademarks
Dynamic Threat Prevention System (DTPS), APSecure, FortiASIC, FortiBIOS, FortiBridge, FortiClient,
FortiGate®, FortiGate Unified Threat Management System, FortiGuard®, FortiGuard-Antispam,
FortiGuard-Antivirus, FortiGuard-Intrusion, FortiGuard-Web, FortiLog, FortiAnalyzer, FortiManager,
Fortinet®, FortiOS, FortiPartner, FortiProtect, FortiReporter, FortiResponse, FortiShield, FortiVoIP, and
FortiWiFi are trademarks of Fortinet, Inc. in the United States and/or other countries. The names of actual
companies and products mentioned herein may be the trademarks of their respective owners.

Wireless Starter Kit Guide
01-420-139115-20110223 3
http://docs.fortinet.com/ • Feedback
Contents
FortiAP™ Wireless Starter Kit 5
FortiAP unit overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Rear panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Front panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Power options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
FortiGate wireless controller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Connecting the hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Checking the firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Obtaining and installing the FortiGate firmware . . . . . . . . . . . . . . . . . . . 9
Obtaining and installing the FortiAP firmware . . . . . . . . . . . . . . . . . . . 10
Installing the Starter Kit configuration . . . . . . . . . . . . . . . . . . . . . . . . . 10
Obtaining the configuration file . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Demonstrating authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Discovering and enabling the FortiAP units . . . . . . . . . . . . . . . . . . . . 11
Confirming that the wireless access points are activated . . . . . . . . . . . . . 12
Viewing the profile-based configuration . . . . . . . . . . . . . . . . . . . . . . 12
Checking wireless signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Captive portal demonstration. . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
WPA shared key demonstration . . . . . . . . . . . . . . . . . . . . . . . . . . 14
WPA/WPA2-Enterprise demonstration . . . . . . . . . . . . . . . . . . . . . . . 14
WPA Client Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
WPA/WPA2-Enterprise with external database demonstration . . . . . . . . 14
WPA/WPA2-Enterprise with local database demonstration . . . . . . . . . . 14
Monitoring traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Rogue AP scanning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Contents
Wireless Starter Kit Guide for FortiOS 4.0 MR2
401-420-139115-20110223
http://docs.fortinet.com/ • Feedback

Wireless Starter Kit Guide
01-420-139115-20110223 5
http://docs.fortinet.com/ • Feedback
FortiAP™ Wireless Starter Kit
The purpose of the Wireless Starter Kit is to provide a very cost effective and simplified
way to showcase the capability of FortiAP wireless access points. This document
introduces the FortiAP unit and the FortiOS wireless controller feature as demonstrated in
the Starter Kit.
FortiOS is the operating system of FortiGate and FortiWiFi units.
FortiAP unit overview
A FortiAP unit, of which there are several models, is a compact wireless access point
device. Indoor units can be wall-mounted or ceiling mounted. An optional ceiling tile rail
mount is available. It is also acceptable to place the unit on a desktop or shelf. There is
also an outdoor model available.
The FortiAP unit contains the radio equipment required for a wireless access point. It must
be controlled by a FortiGate or FortiWiFi unit.
Features
• Most models have dual radios for simultaneous 802.11a/n & 802.11 b/g/n operation.
FortiAP-210B is a single-radio model.
• Four high-gain dual band (2.4GHz, 5GHz) omni-directional antennas. Single radio
models have two antennas. Indoor models have internal antennas.
• 2x2 MIMO configuration using the latest signal processing technology. 600Mbps total
throughput for dual-radio units, 300Mbps for single-radio units.
• 14 SSIDs for client access, (7 for single radio models)
• 2 SSIDs for dedicated monitoring, (1 for single radio models)
• Firmware upgradable through the wireless controller.

FortiAP unit overview FortiAP™ Wireless Starter Kit
Wireless Starter Kit Guide for FortiOS 4.0 MR2
601-420-139115-20110223
http://docs.fortinet.com/ • Feedback
Rear panel
All connections to the FortiAP unit are made on the real panel.
In typical use as a wireless access point, only Port 0 is used. An Ethernet cable connects
Port 0 to a port on the FortiGate unit. The Power jack is connected to the power supply
provided with the FortiAP unit. Optionally, you can use a power-over-Ethernet (POE)
adaptor to avoid the need for a power outlet near the FortiAP unit. In that case, the power
output of the POE adaptor connects to the Power jack.
Front panel
The front panel contains indicators that show the status of the unit.
Port 1, 2, 3, 4 Green indicates a connection to the corresponding port on the rear panel.
Wireless Flashing indicates wireless network running.
Port 0 Green indicates a network connection to Port 0 on the rear panel.
Port 0 connects to the FortiGate unit that acts as the wireless controller.
Power Flashing - power connected but unit not managed.
Lit steadily - indicates that the unit has power and is managed.

FortiAP™ Wireless Starter Kit FortiAP unit overview
Wireless Starter Kit Guide
01-420-139115-20110223 7
http://docs.fortinet.com/ • Feedback
Power options
The FortiAP unit requires 12 volts and power supply with universal 100-240 volt input is
provided. If power is not conveniently available at the mounting location, it is possible to
use a power-over-Ethernet (POE) adaptor to feed 12 volt power to the device through the
Ethernet cable. POE adaptors have two components: one to combine power and Ethernet
and the other to separate them again. The wiring looks like this:
FortiAP units have been tested with the LinkSys WAPPOE12 adaptor. Use the power
supply provided with the FortiAP, rather than the power supply provided with the POE unit.

FortiOS wireless controller FortiAP™ Wireless Starter Kit
Wireless Starter Kit Guide for FortiOS 4.0 MR2
801-420-139115-20110223
http://docs.fortinet.com/ • Feedback
FortiOS wireless controller
The FortiOS wireless controller feature enables FortiGate and FortiWiFi units to manage
FortiAP units. The wireless controller configuration is composed of three types of objects:
Virtual AP — defines the security settings for your wireless network. This is similar to the
wlan interface settings on a FortiWiFi unit and it creates a virtual network interface.
AP Profile — defines the radio settings, such as band (802.11g for example) and channel
selection. It also selects the Virtual APs to which the settings apply. Any change to the AP
Profile affects all APs assigned to that profile.
Physical AP — represents the FortiAP units that the wireless controller has discovered.
There is one physical access point definition for each FortiAP unit. The Physical AP
configuration selects the AP Profile that applies that FortiAP unit.
Connecting the hardware
Connect all of the hardware as described below.
To connect the FortiAP unit to the wireless controller
1Connect Port 0 of one FortiAP unit to one of the Internal ports on the FortiGate unit.
2Connect Port 0 of the other FortiAP unit to the DMZ port on the FortiGate unit.
1After mounting the FortiAP unit, connect the Ethernet cable to Port 0 and connect the
power supply to the Power jack.
2Connect the WAN1 port of the FortiGate unit to the Internet.
3At each FortiAP unit, connect the power supply (or the power cable of the POE unit) to
the Power jack.
4Connect the power supply to the FortiGate unit.
The FortiGate supply is rated at 3A. The FortiAP supplies are 1.5A.

FortiAP™ Wireless Starter Kit Checking the firmware
Wireless Starter Kit Guide
01-420-139115-20110223 9
http://docs.fortinet.com/ • Feedback
Checking the firmware
You need to verify that the units have the appropriate firmware installed. If the firmware is
not correct, you can download and install appropriate firmware.
To verify the FortiGate unit firmware
1Connect a computer to one of the Internal ports.
2Use a browser to connect to http://172.16.1.1.
3Log in with user name “Admin” and password “fortinet”.
4Go to System > Dashboard > Status and check the Firmware version in System
Information.
If the build number is not 6390, see “Obtaining and installing the FortiGate firmware”,
next.
To verify the FortiAP unit firmware
1On the FortiGate unit, go to Wireless Controller > Configuration > Access Points.
2The FortiAP units should be listed. If necessary, select Refresh.
3If the Version column does not show build 112, see “Obtaining and installing the
FortiAP firmware” on page 10.
Obtaining and installing the FortiGate firmware
In FortiOS 4.0 MR2, only build 6390 supports wireless controller functionality. If your
FortiGate does not already have this firmware loaded, you need to download build 6390
from the Customer Support web site.
To get the wireless controller firmware for your FortiGate unit
1Log on to the Support web site at https://support.fortinet.com/.
2Go to Download > Firmware Images.
3Select FortiAP > v4.00 > 4.0MR2 > MR2_Patch_2 > Wireless_controller.
4Download the firmware build for your FortiGate model.

Installing the Starter Kit configuration FortiAP™ Wireless Starter Kit
Wireless Starter Kit Guide for FortiOS 4.0 MR2
10 01-420-139115-20110223
http://docs.fortinet.com/ • Feedback
To install the firmware on the FortiGate unit
1Log in to the FortiGate unit with user name “Admin” and password “fortinet”.
See “To verify the FortiGate unit firmware” on page 9 or see the unit’s QuickStart Guide
for more information.
2Go to System > Maintenance > Firmware and select Upgrade.
3Select Browse, find the firmware that you downloaded and then select OK.
Obtaining and installing the FortiAP firmware
The configuration of the Starter Kit is based on FortiAP firmware version 112. If this is not
the installed version on the FortiAP units, you need to download and install build 112.
To get FortiAP firmware
1Log on to the Support website at https://support.fortinet.com/.
2Go to Download > Firmware Images.
3Select FortiAP > v4.00 > 4.0MR2 > MR2_Patch_2.
4Download the file that corresponds to your model.
The Starter Kit contains FortiAP-220A units, FAP_22A_v4.2.0_b0112 is the correct file.
5Copy the file to a TFTP server accessible from your FortiGate unit.
To install the firmware on the FortiAP units
1Log in to the FortiGate unit with user name “Admin” and password “fortinet”.
See “To verify the FortiGate unit firmware” on page 9 or see the unit’s QuickStart Guide
for more information.
2Go to System > Dashboard > Status and enter the following command in the
CLI Console: (substitute your TFTP server IP address for x.x.x.x)
execute wireless-controller upload-wtp-image tftp
FAP_22A_v4.2.0_b0112 x.x.x.x
3After the upload completes, go to Wireless Controller > Configuration > Access Points,
select the FortiAP units and then select Reset All.
4After the reset completes, check that the Version column shows build 112.
Installing the Starter Kit configuration
The Starter Kit includes a configuration file which simplifies entering the correct
configuration settings into your FortiGate unit.
Obtaining the configuration file
The Customer Support site has a configuration file for a FortiGate-80CM with two FortiAP-
220A units. The configuration file can be modified for other FortiGate models.
To download a configuration file
1Log on to the Support web site at https://support.fortinet.com/.
2Go to Download > Firmware Images.
3Select FortiAP > StarterKit.
4Download StarterKit/Starter_Kit_FG-80CM_4.0MR2Patch1_20100916.zip.
5Expand the .zip file to obtain the configuration file FG-80-Starter_Kit_20100907.conf.