FortiGate controls traffic between network zones, FortiSwitch connects wired devices, and FortiAP provides wireless coverage. Start with segmentation, AP locations and power requirements rather than a shopping list of devices.
Map VLANs and allowed traffic
Separate staff, guest, cameras/IoT and management where appropriate. For example, guests may need internet access only, while cameras may only need a recorder and approved admin hosts. Define DHCP, DNS, VLAN tagging and inter-VLAN policy before configuring SSIDs.
Check FortiLink and PoE
Verify the switch model and firmware compatibility with FortiGate. Plan FortiLink and uplinks around your redundancy needs, then check per-port and total PoE capacity. A standard FS-124F does not supply PoE, so APs need compatible injectors or another approved power source.
Place access points based on the floor plan
Review walls, device density and coverage overlap. Check client Wi-Fi standards and wired uplink speeds. Do not use a theoretical wireless rate to infer coverage area or user capacity.
Acceptance tests
Verify that guests cannot reach internal networks, staff can access approved applications, and APs receive power and configuration after restart. Test redundant uplinks where fitted. Hand over the port and VLAN map, configuration backups and administrator access.
Example policy and acceptance matrix
| Flow | Example policy | Acceptance test |
|---|---|---|
| Guests → internet | Allow internet; deny internal networks | Web access works; internal servers are unreachable |
| Staff → applications | Allow only required destinations and ports | Approved application works; unrelated access is denied |
| Cameras → recorder | Allow required recorder traffic only | Recording works; staff VLAN is unreachable |
| Admins → equipment | Allow designated management hosts or VLAN | Approved source connects; other sources are denied |
Example PoE calculation
Assume four APs each require up to 18 W according to the datasheet for the selected device. The AP load is 72 W before other equipment and reserve capacity. Check per-port power and the switch total. These are example figures, not the specification of a named FortiAP model.
A safer cutover sequence
Back up the old configuration and identify a fallback management connection. Pilot one switch and one AP, then test DHCP, DNS, SSIDs, VLANs and business applications. Expand only after tests pass. If management access or a critical application fails, follow the agreed rollback plan.
Handover records
Keep the physical port map, VLAN/SSID inventory, approved flows, test results and configuration backup. Identify who owns alerts and can restore service. Keep passwords and VPN keys out of shared diagrams.
References and consultation
Official Fortinet documentation · Browse equipment in Store
Explore business FortiGate solutions · Request a consultation
Unstable office network that needs redesigning?
IT Systems surveys, designs and deploys LAN, Wi-Fi, firewall and VPN for offices and branches, with full documentation.
