Technical Tip: Multiple VLANs in FortiGate with same MAC address

In FortiGate, multiple VLAN interfaces can share the same MAC address, especially when they are created under the same physical interface.

By default, VLAN sub-interfaces inherit the MAC address of their parent interface and FortiGate does not assign unique MAC addresses to the VLAN interfaces bind to a specific interface.

• VLANs on the Same Physical Interface: When multiple VLANs are created under the same physical interface they assign the MAC address of the physical interface.
• VLANs on Different Physical Interfaces: If VLANs are created on different physical interfaces, they will have different MAC addresses because each physical interface has its own unique MAC.

Change of MAC address scope:

In FortiGate, the MAC address of a VLAN interface cannot be manually changed. VLAN subinterfaces automatically assign the MAC address of their parent physical interface, and FortiGate does not provide an option to modify it.

In this case, if the same Mac address creates layer2 conflicts the following workarounds can be followed:

• Use Different Physical Interfaces.
• Enable Independent VLAN Forwarding.
• Use a FortiSwitch for VLAN Handling.
• Use Virtual Wire Pair (VWP) or Transparent Mode.
• Use enhanced MAC VLAN interface the same way as normal VLAN interfaces

Related documents:
Technical Tip: vlanforward interface parameter
Configuring VLANs(FortiSwitch)
Technical Tip: Virtual Wire Pair (VWP) and connectivity with Non-VWP interfaces

Enhanced MAC VLAN - FortiGate administration guide 7.4.7