30E Hardware Switch - can't have port in "access" VLAN mode?

Forum|Forum|8 years ago
January 22, 2018
8 replies
16045 views

New to Fortigate, have a 30E running latest 5.6 firmware. I am trying to understand the process of creating VLANs on the device.

It appears to me that, from the hardware switch containing LAN ports 1-4, you can create VLANs with VLAN IDs and unique router IP addresses for each VLAN. Then you can connect to the "trunk" port of another switch to any of the 4 ports and configure matching VLAN IDs on the separate switch. This works as far as I can tell.

But how would I configure a port on the Fortigate to be in "access" VLAN mode? For example, I create VLANs 10, 20, and 30 under the Hardware Switch. I don't see a way to have port 1 assigned to VLAN 10, port 2 to VLAN 20, port 3 to VLAN 30, and then maybe port 4 would be a trunk of all VLANs to a separate switch. If I remove a port from the hardware switch, I don't see any VLAN settings at all in the GUI config (no option for native VLAN, default VLAN, or anything at all.)

So is this scenario not possible on the 30E?

Best answer by Toshi_Esumi

As far as I know FortiGate's VLAN architecture doesn't support access ports.

Toshi_EsumiAnswer

SuperUser

As far as I know FortiGate's VLAN architecture doesn't support access ports.

Toshi_Esumi

SuperUser

And one vlan subinterface can be attached to one parent interface only. You can't attach "vlan 10" to lan1 and lan4 separately. You need to aggregate those into a hard/soft-switch to do that, which would break your design. You have to do the vlan break-up at the outside L2 switch after handing all vlans to it.

dmcquade

New Member

Remove one of the ports from the hardware switch. You should then be able to create VLAN interfaces assigned to this port. Make sure the switch interface the port is connected to is configured as a trunk. The switch will also need the same VLAN IDs.

HTH

d

train_wreckAuthor

New Member

Interesting that it doesn't support access ports, and a bit disappointing. Seems like a somewhat odd restriction to have.

dmcquade

New Member

A firewall port not part of the switch can certainly be an access port. Assign it an IP and cable it to a switch port that setup for static access and assign it the VLAN there. You can also setup the interface to receive an address via DHCP but that is a more complex setup as it is for specific circumstances (such as dynamic IP from ISP) and can cause other issues.

So you can have port 1 be associated with VLAN 10, port 2 VLAN 20 and port 3 VLAN 30. Not sure why you would then want to have port 4 be a trunk with the same VLANs. The purpose of the firewall is to inspect traffic as it routes (or passes through in transparent mode at layer 2). What are you trying to achieve?

Sign up

Login with SSO

Login to the community

Login with SSO