Creating SSIDs

In central management mode, the SSIDs are profiles that can be applied to multiple controllers. SSID profiles can be created for different traffic modes, including Tunnel, Bridge, or Mesh. The settings available in the GUI change depending on which traffic mode is selected.

For more information on SSID settings, see the FortiWiFi and FortiAP Configuration Guide on the Fortinet Document Library.

When you create SSID profiles, you can select a QoS profile and/or an L3 firewall profile.

FortiManager includes Fortinet recommended factory default SSID profiles that you can activate and use in your environment. See Using Fortinet recommended profiles.

To create a new SSID:

1. Go to AP Manager > SSIDs.

2. In the toolbar, click Create New > SSID. The Create New SSID Profile windows opens.

   

3. Enter the following information, then click OK to create the new tunnel to wireless controller SSID:

   Name		Type a name for the SSID.
   Alias		Set the alias for SSID.
   Traffic Mode		Select the traffic mode: Tunnel, Bridge, or Mesh.
   Address		These options are only available when Traffic Mode is Tunnel.
   	Address Mode	Select Manual or IPAM.
   	When to use IPAM	Choose Always or Inherit IPAM auto-manage settings. This setting is only available when the IPAM Address Mode is selected.
   	Network Size	Select the network size. IPAM will allocate an IP subnet with the selected size. This setting is only available when the IPAM Address Mode is selected.
   	IP/Network Mask	Enter the IP address and netmask for the SSID. This setting is only available when the Manual Address Mode is selected.
   	IPv6 Address	Enter the IPv6 address.
   Administrative Access
   	Administrative Access	Select the allowed administrative service protocols.
   	IPv6 Administrative Access	Select the allowed administrative service protocols.
   DHCP Server		Enable or disable a DHCP server. To assign IP addresses to clients, enable DHCP server.
   	DHCP Status	Set the DHCP status as Enabled or Disabled.
   	IP Range Managed by IPAM	Choose if the IP range is managed by IPAM.
   	Default Gateway	Choose the default gateway as Same as Interface IP or Specify to configure the gateway.
   	DNS Server	Choose the DNS server as Same as System DNS, Same as Interface IP, or Specify to configure the DNS server.
   	Lease Time	Set the lease time. Disabling the lease time will result in clients having an unlimited lease time.
   Network
   	Device Detection	Enable or disable device detection.
   WiFi Settings
   	SSID	Type the wireless service set identifier (SSID), or network name, for this wireless interface. Users who want to use the wireless network must configure their computers with this network name.
   	Client Limit	The maximum number of clients that can simultaneously connect to the AP (0 - 4294967295, default = 0, meaning no limitation).
   	Broadcast SSID	Enable/disable broadcasting the SSID (default = enable). Broadcasting enables clients to connect to the wireless network without first knowing the SSID. For better security, do not broadcast the SSID.
   	Encrypt	Select the data encryption protocol: TKIP: Temporal Key Integrity Protocol, used by the older WPA standard. AES: Advanced Encryption Standard, commonly used with the newer WPA2 standard (default). TKIP-AES: Use both protocols to provide backward compatibility for legacy devices. This option is not recommended, as attackers will only need to breach the weaker encryption of the two (TKIP). This option is only available when the security mode includes WPA or WPA2.
   	Security Mode	Select a security mode: Captive Portal WPA Only Personal OPEN WPA Only Personal Captive Portal Osen OWE WPA Personal WEP 128 WPA Personal Captive Portal WEP 64 WPA2 Only Enterprise WPA Enterprise WPA2 Only Personal WPA Only Enterprise WPA2 Only Personal Captive Portal WPA3 Enterprise WPA3 SAE WPA3 SAE Transition Only WPA and WPA2 Personal modes are available when the traffic mode is Mesh.
   	PMF	Set PMF settings as Disabled, Enabled, or Optional.
   	Pre-shared Key Mode	Select Single to specify a single passphrase. Select Multiple to specify a multiple pre-shared key group.
   	Passphrase	When Pre-shared Key Mode is set to Single, enter the pre-shared key for the SSID. This option is only available when the security mode includes WPA or WPA2 personal.
   	Local Standalone	Enable/disable AP local standalone (default = disable). This option is only available when the traffic mode is Bridge.
   	Local Authentication	Enable/disable AP local authentication. This option is only available when the traffic mode is Bridge.
   	Client Limit per Radio	The maximum number of clients that can simultaneously connect to each radio (0 - 4294967295, default = 0, meaning no limitation). This option is only available when Local Standalone is enabled.
   	Multiple Pre-Shared Keys	Enable/disable multiple pre-shared keys. In the table, click Create to create a new key. Enter the key name, value, client limit, and comments (optional), then click OK. Click Edit to edit the selected key. Click Delete to delete the selected key or keys. This option is only available when the security mode includes WPA or WPA2 personal and the traffic mode is not Mesh.
   	Default Client Limit Per Key	Enable/disable a maximum number of clients that can simultaneously connect using each pre-shared key, then enter the maximum number. This option is only available when the Multiple Pre-Shared Keys is enabled.
   	Portal Type	Select the portal type: Authentication (default), Disclaimer + Authentication, Disclaimer Only, or Email Collection. This option is only available when the security mode includes captive portal.
   	Authentication Portal	Select Local or External. If External is selected, enter the URL of the portal. This option is only available when the portal type includes authentication.
   	User Groups	Select the user group to add from the dropdown list. Select the plus symbol to add multiple groups. This option is only available when the portal type includes authentication.
   	Exempt Sources	Select exempt sources to add from the dropdown list. This option is only available when the portal type includes authentication.
   	Devices	Select exempt devices to add from the dropdown list. This option is only available when the portal type includes authentication.
   	Exempt Destinations	Select exempt destinations to add from the dropdown list. This option is only available when the portal type includes authentication.
   	Exempt Services	Select exempt services to add from the dropdown list. This option is only available when the portal type includes authentication.
   	Customize Portal Messages	Select to allow for customized portal messages. Portal messages cannot be customized until after the interface has been created. This option is only available when the portal type includes disclaimer, email collection, or CMCC without MAC authentication.
   	Redirect after Captive Portal	Select Original Request or Specific URL. If Specific URL is selected, enter the redirect URL. This option is only available when the security mode includes captive portal.
   	Authentication	Select the authentication method for the SSID, either Local or RADIUS Server, then select the requisite server or group from the dropdown list. This option is only available when the security mode is includes WPA or WPA2 enterprise.
   	Schedule	Select a schedule to control the availability of the SSID. For information on creating a schedule object, see Creating objects.
   	Access Control List	Select an access control list profile from the drop-down list. See L3 firewall profiles.
   	Block Intra-SSID Traffic	Enable/disable blocking communication between clients of the same AP (default = disable).
   	Broadcast Suppression	Optional suppression of broadcast message types: All other broadcast: All other broadcast messages All other multicast: All other multicast messages ARP poison: ARP poison messages from wireless clients ARP proxy: ARP requests for wireless clients as a proxy ARP replies: ARP replies from wireless clients ARPs for known clients: ARP for known messages ARPs for unknown clients: ARP for unknown messages DHCP downlink: Downlink DHCP messages DHCP starvation: DHCP starvation req messages DHCP uplink: Uplink DHCP messages IPv6: IPv6 packets NetBIOS datagram service: NetBIOS datagram services packets NetBIOS name service: NetBIOS name services packets
   	Filter Clients by MAC Address	Enable/disable using a RADIUS server to filter clients be MAC address, then select the server from the drop-down list. See RADIUS servers for information on adding a RADIUS server.
   	VLAN Pooling	Enable/disable VLAN pooling, allowing you to group multiple wireless controller VLANs into VLAN pools. These pools are used to load-balance sessions evenly across multiple VLANs. Managed AP Group: Select devices to include in the group. Round Robin Hash This option is not available when the traffic mode is Mesh.
   	Quarantine Host	Enable/disable station quarantine (default = enable). This option is only available when the security mode includes WPA or WPA2.
   	QoS Profile	Select a QoS profile from the dropdown list. See QoS profiles.
   	L3 Firewall Profile	Select a L3 firewall profile from the dropdown list. See L3 firewall profiles.
   Advanced Options		Configure advanced options. For information, see the FortiOS CLI Reference.
   Per-Device Mapping		Enable per-device mapping to override the SSID profile settings for selected devices. See Adding SSID per-device mapping.

If you select WPA Enterprise, WPA Only Enterprise, or WPA2 Only Enterprise, you can add a different RADIUS server using per-device mapping. See Adding SSID per-device mapping.