🏢 Enterprise Network Infrastructure Upgrade
CIMMYT Nepal Office, Khumaltar
From a flat unmanaged network to a fully segmented enterprise-grade dual-VLAN architecture using existing hardware with zero budget.
Project Overview
The CIMMYT Nepal Office in Khumaltar, Lalitpur was running on a completely flat network with no VLANs, no segmentation and no guest isolation. All staff devices, guest WiFi and printers were sharing the same broadcast domain with zero security boundaries between them.
The goal was straightforward: upgrade the entire network to a properly segmented, enterprise-grade architecture. The interesting constraint was that no new hardware could be purchased. Everything had to be done with what was already sitting in the server rack.
How It Unfolded
Before and After
❌ Before
✅ After
Hardware Involved
Every device below was already present in the office. Nothing was purchased new. Each one was reconfigured from scratch.
Firewall policies and FortiAP controller
Core switch plus two access switches
CIM-WiFi on 5GHz, cim-guest on 2.4GHz
Dedicated coverage for CCR area
Network Design
The topology follows a daisy-chain design with the FortiGate at the top and three switches cascading below it. Two VLANs carry all traffic with strict firewall policies controlling what can communicate with what.
🏢 VLAN 20 — Corporate
👥 VLAN 999 — Guest
FortiGate Configuration Highlights
A couple of things worth noting from the FortiGate side. SD-WAN must be configured before any firewall policies that reference it, otherwise FortiOS throws a node_check_object error. Also, VLAN IDs are immutable after creation — to change one you delete the interface and start over.
Wireless Network Setup
Moving CIM-WiFi to 5GHz was the single biggest factor in the speed improvement. The 5GHz band is faster and far less congested in an office environment. Eight access points were spread across the building with 2.4GHz channels carefully planned to use only non-overlapping channels rotating across 1, 6 and 11 so adjacent APs never interfere with each other.
Challenges Worth Sharing
FortiAP CIM-WiFi Had No DHCP
Setting Optional VLAN ID to 20 on the Bridge mode SSID was not giving IP addresses to clients connecting to CIM-WiFi on the FortiAP.
Set VLAN ID to 0
VLAN ID 0 sends traffic untagged. The switch native VLAN routes untagged traffic to the corporate VLAN interface on FortiGate. DHCP works perfectly.
FortiAP Not Appearing in FortiGate
The FortiAP 231F was getting an IP and could ping the FortiGate but would not show up in Managed FortiAPs no matter what was tried.
Enable Security Fabric Connection
Since FortiOS 6.2, CAPWAP is grouped under Security Fabric Connection in the interface administrative access settings. Enabling this on the management VLAN interface fixed it immediately.
FortiAP Still Talking to FortiEdge Cloud
Even after pointing the FortiAP at the local FortiGate IP it kept trying to reach the cloud controller it was previously registered to.
Undeploy from FortiEdge Cloud First
The AP must be released from the FortiEdge Cloud portal before it will accept a local controller. Once undeployed it connected to the FortiGate within minutes.
FortiOS VLAN ID Cannot Be Changed
Attempted to modify an existing VLAN interface to change the VLAN ID. FortiOS does not allow this operation in place.
Delete and Recreate
The only way to change a VLAN ID in FortiOS is to delete the interface and create a new one. All firewall policies referencing it must be removed first.
What I Learned
💡 Native VLAN and FortiAP Bridge Mode
When a Cisco switch trunk port has a native VLAN configured, any traffic tagged with that same VLAN ID gets the tag stripped before leaving the port. This catches people out with FortiAP. The fix is counterintuitive set the SSID Optional VLAN ID to 0 instead of the VLAN number and the untagged traffic flows exactly where you need it.
💡 Performance Is About Design, Not Hardware
The jump from 7 Mbps average to 41.8 Mbps on the same access points came from three things: moving corporate WiFi to the 5GHz band, planning 2.4GHz channels using only the three non-overlapping channels and fixing the VLAN trunk configuration on the switches. No hardware replaced. Proper configuration is everything.
💡 SD-WAN Must Come Before Firewall Policies
If you try to create a firewall policy referencing virtual-wan-link before the SD-WAN zone is configured, FortiOS throws a node_check_object error. Always configure SD-WAN first then build firewall policies on top of it.
Final Results
Every test passed. The network is stable, fast and properly segmented. Staff on CIM-WiFi cannot reach the guest network and guests cannot reach any corporate resource. The FortiAP covers the previously weak CCR area and everything is documented in NetBox.
| Test Performed | Result |
|---|---|
| FortiGate internet connectivity | ✅ Passed |
| Wired PCs on all three switches | ✅ Passed |
| CIM-WiFi on Cisco APs | ✅ Passed — 41.8 Mbps / 1ms jitter |
| CIM-WiFi on FortiAP 231F | ✅ Passed |
| cim-guest on Cisco APs | ✅ Passed |
| cim-guest on FortiAP 231F | ✅ Passed |
| Guest to corporate isolation | ✅ Passed — completely blocked |
| All 8 Cisco APs reachable | ✅ Passed |
| NetBox documentation | ✅ Complete |
Namaste, I'm deeply passionate about crafting articles that provide meaningful insights and knowledge through my blog. My aim is to deliver engaging and thought-provoking content that resonates with you. I appreciate your visit and hope that my work not only informs but also inspires you.
>
