+32 (491)

Transcription

1 Whitepaper: Fortinet wireless Title: FAP 221C & Fortigate 60D Author: Jurgen Vermeulen +32 (491) JUVE Consulting BVBA Roosgrachtlaan 27, B-3400 Landen Tel.: +32 (491)

2 Table of Contents Table of Contents 1 INTRODUCTION TEST SETUP FIREWALL & WLC ACCESS POINTS NETWORK TESTING EQUIPMENT TEST CONFIGURATION CONNECTING THE ACCESS POINTS THE FORTIAP PROFILES SSID CONFIGURATION FIREWALL POLICIES LOCAL AP MANAGEMENT INTERFACE TEST RESULTS CLEAR TEXT CONNECTION (DTLS DISABLED) BRIDGED MODE (WIFIKEUH SSID) TUNNELED MODE (WIFIKEUH2 SSID) ENCRYPTED CONNECTION (DTLS ENABLED) BRIDGED MODE (WIFIKEUH SSID) TUNNELED MODE (WIFIKEUH2 SSID) RANGE GENERIC REMARKS HTTP CONNECTION TO THE AP CLEAR TEXT CONNECTION BY DEFAULT FIRMWARE CONCLUSION MORE INFORMATION /05/2014, V 0.1 <public> Page i

3 Introduction 1 Introduction I ve been running a Fortigate 60D firewall for a while now and was looking to replace my home wireless by a more stable solution. Since my Fortigate can also be used as a WLC for FortiAP access points, I decided to give them a try. The main focus on the document will be on basic installation and performance, but there are more features available. 08/05/2014, V 0.1 <public> Page 1

4 Test setup 2 Test setup 2.1 Firewall & WLC The firewall used in the test is Fortinet s Fortigate 60D with following configuration: - LAN interface, WAN interface + secondary WAN link - UTM enabled - No dedicated interface for FortiAP - FortiOS Access points For this test, I used 2 FortiAP 221C units. The main specs are: - Dual radio. - Internal antenna s AC capable (on 2 nd radio) - POE capable - 1 Gbps connection - Firmware AP is located on the ground floor, 1 AP is located on the first floor. 2.3 Network The LAN network is built on TP-LINK smart managed switches. Both the access points and firewall are connected to a TP-Link SG2424P switch, with the AP s being powered by the switch POE ports (POE injectors are available as well). 2.4 Testing equipment The following equipment was used during the tests: - Samsung galaxy tab 3 8.0inch - Samsung series 5 laptop (Win7 pro 64 bit) - Desktop computer (Win7 pro 64 bit) - Wifi speed test: android application to test your network speed. Server executable installed on the Win7 machines. - XBMC Unfortunately, I don t have any AC capable equipment today, so I wasn t able to test this. 08/05/2014, V 0.1 <public> Page 2

5 Test configuration 3 Test configuration 3.1 Connecting the Access Points Connecting the equipment to the network is very easy: - Enable CAPWAP on the Fortigate interface(s) facing the AP - Enable wireless controller feature in case it is turned off. - Create a wireless profile & assign correct country code - Hook up the AP to the network. - Authorize it on the Fortigate. - Assign the profile created in step 3 (right-click on the AP name) The result is something like this: Under Monitor -> wireless health you can get an overview of generic wireless related data: 08/05/2014, V 0.1 <public> Page 3

6 Test configuration Under Client monitor, you get an overview of all wireless clients that are currently connected: 3.2 The FortiAP profiles The FortiAP profile contains all settings you want to assign to a specific AP or group of AP s. Each AP hardware has a specific default profile, and you can create custom profiles as you wish. Spectrum analysis will give you readings on rogue access points and can help you determine which are the best wireless channels to use. I disabled channel 11 on radio 1, as it is the most used in my neighbourhood and using it has a performance impact. The client load balancing features allow for the access points to pass clients to least used nodes or to spread the frequencies between the different access points. 08/05/2014, V 0.1 <public> Page 4

7 Test configuration By default, the AP and Fortinet support both clear text or DTLS encryption channels. If both are available, clear text will be chosen automatically. You can force encryption by either changing the AP or WLC profile configuration. Using DTLS combined with tunneled traffic (see below) does have a performance impact. 3.3 SSID configuration Each AP can handle multiple SSIDs. You create the ones you need on the Fortigate WLC and assign the required ones to each FortiAP profile. There are 2 ways to configure an SSID: - Bridged to local interface: this will use the AP s LAN interface to send data to the network. You can use this mode when the AP is connected directly to your LAN and you want to avoid the overhead of tunneling traffic towards the Fortigate. 08/05/2014, V 0.1 <public> Page 5

8 Test configuration - Tunneled mode: all traffic from and to clients connected to these SSIDs will be sent through a tunnel between the AP and firewall. You can create several networks assigned to different profiles and these networks only need to exist at the firewall, not on the AP s LAN connection point. 08/05/2014, V 0.1 <public> Page 6

9 Test configuration 3.4 Firewall policies You can create policies using the assigned network interfaces linked to the SSIDs. 08/05/2014, V 0.1 <public> Page 7

10 Test configuration 3.5 Local AP management interface It is possible to make some configuration changes to the AP through HTTP or telnet (needs to be manually enabled + access will be disabled once a connection to a WLC is made). This is needed when you connect the AP to a remote location and it isn t able to autodiscover the WLC parameters. You can also assign a static IP and monitor the wireless radio. 08/05/2014, V 0.1 <public> Page 8

11 Test results 4 Test results 4.1 Clear text connection (DTLS disabled) Bridged mode (Wifikeuh SSID) When connected to the AP in bridged mode, it s possible to get an average throughput of 39 mbps, which is better than what I ve seen on my other equipment. The signal allows to play back a 1080p mkv with 5.1 surround without any issues when not too far away from the AP. 08/05/2014, V 0.1 <public> Page 9

12 Test results Tunneled mode (Wifikeuh2 SSID) Next, I switched to the Wifikeuh2 SSID, which has all traffic tunneled towards the Foritgate WLC, and is then routed onto the network. Results were very similar: There s little overhead and you don t notice any difference when connected to this SSID. Video kept playing smoothly as well. 08/05/2014, V 0.1 <public> Page 10

13 Test results 4.2 Encrypted connection (DTLS enabled) Bridged mode (Wifikeuh SSID) When connected in bridge mode, you observe no speed difference when connected. This is logical, because all traffic is handed off through the LAN port of the AP, directly onto the network instead of being sent through the tunnel. Only control data is encrypted over the link between the AP and the WLC Tunneled mode (Wifikeuh2 SSID) Where you do notice a difference, is in the tunneled SSIDs. When performing the same tests on a DTLS channel, my performance dropped to around 11 mbps: Both the AP s and the Fortigate s CPU went very high. While this speed is more than enough to do some surfing and office work, don t expect to stream full HD content over the DTLS link without any issues. If the AP is located remotely and needs to connect over an untrusted connection, DTLS is a must have, so keep this in mind when scaling the equipment. 08/05/2014, V 0.1 <public> Page 11

14 Test results 4.3 Range One of the main drawbacks of my old wifi equipment was range. I used to have a Linksys WRT54GS, flashed DD-WRT on it and boosted transmit power to maximum to get some decent coverage. My second AP was a Netgear router with Wireless-N, dual band radio and that was barely able to server 1 floor in the house. Roaming between them was also impossible. I was pleasantly surprised that with 2 access points, I now have decent wireless coverage throughout the entire house (ground floor, first floor and second floor), while having a lot of concrete and metal used throughout the house. Roaming is also working very well, thanks to the cooperation between the access points. I didn t perform any VOIP tests yet, but I don t get disconnected for a minute anymore when moving from one floor to another. 4.4 Generic remarks HTTP Connection to the AP While telnet gets disabled once the AP connects to the controller, and there aren t that many options to configure on the AP, having a HTTPS interface would be preferred over HTTP. In the mean time, take this into account and make sure to use a different password and change it frequently in order to manage the AP from the web interface Clear text connection by default The recommended setup for deploying AP s is slightly different from what I did, ie. Connecting the AP s to a dedicated Fortigate interface that is separated from the rest of the network, so I understand that from a performance point of view, the default way of connecting the AP is using a clear text connection. However, since we re talking about a security product, I would rather see the most secure option being chosen in case of multiple possibilities. By default, both clear text and DTLS are enabled, so logic would be to use DTLS. If you want to use clear text as default to bypass possible performance impact, make clear text the default setting and not both options Firmware The FAP 221C is a new product and the FortiOS being a new major release, there still are some hickups. The AP s second radio sometimes doesn t appear as functional in the Managed AP view, while it seems active on the AP itself, performing frequent changes confuse the AP and Fortigate, and I had to do 2 or 3 reboots of the AP s because of some weird behavior. Once I put on a final configuration and didn t fiddle with it every couple of minutes, the setup was very stable though. These are some minor issues that should disappear in the coming firmware updates. 08/05/2014, V 0.1 <public> Page 12

15 Conclusion 5 Conclusion I m very happy with the performance of the AP s and the interconnection between wireless and security. Range and throughput on the AP s is very good, there are some minor bugs present in the current firmware but nothing shocking and It is very easy to deploy. I didn t test every feature yet and focused on performance for now, but I m very impressed with what you get for the money. Most AP s are a lot more expensive and having to manage a separate WLC can be a hurdle. Another option are cloud-managed networks using Meraki/Aerohive/ but if you already have Fortinet equipment installed, the seamless integration is a real plus. 08/05/2014, V 0.1 <public> Page 13

16 More information 6 More information For more information, a live demo or quote, don t hesitate to contact us: JUVE Consulting Jurgen Vermeulen Jurgen@juve-consulting.be +32 (491) /05/2014, V 0.1 <public> Page 14