New Member

Solved

Access To Out of Bound Vlans

Forum|Forum|1 year ago
March 13, 2025
5 replies
1925 views

I have a Fortigate that has two vdoms (root vdom and OOB vdom). The OOB vdom is connected to the Forti-switch and the Forti-switch is being managed by the OOB vdom Fortigate. The Forti-switch has 3 Vlans and all the ports on the Forti-switch have been used. How can I configure a physical port of the Fortigate so that I can access the three Vlans on the Forti-switch Please help with configuration.

FortiGate

Best answer by ebrlima

So first, you need to either move port15 to vdom OOB or configure inter vdom links between vdom root and vdom OOB

About inter-dom link, refer to this: https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/317358/inter-vdom-routing-configuration-example-partial-mesh-vdoms

So your flow would be:

Port15 >>>> Vdom-link(root side) >>>>>Vdom-link (OOB side)>>>>Vlan20

Port15 >>>> Vdom-link(root side) >>>>>Vdom-link (OOB side)>>>>Vlan30

At root vfom you have to have bidirectional rules from port15 to vdom link and from vdom link to port15, and routing so traffic from port15 to vlans 20, 30 is forwarded to the gateway, which will be the ip address of inter-vdom link on OOB side.

At OOB vdom, you configure rules from inter-vdom link to VLAN20 and VLAN30, which are interface vlans on your firewall at OOB side.

Screenshot 2025-03-14 165248.png

Let me know if I can help with something else.

ebrlima

Staff

Hello @Omoyeleola

Based on the information you provided, you might be able to turn one of the physical ports on the Fortigate unit that are connected to the FortiSwitch into a trunk and create the necessary tagged vlan interfaces under it.

This KB shows you how:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-create-a-VLAN-tagged-interface-802-1q-on-a/ta-p/193893

If this is not quite what you need, post more details here and we can try and help you!

OmoyeleolaAuthor

New Member

Dear Lima,

Thank you for your response. I am still seeking a solution to my inquiry. I have attached a file that illustrates the configuration. The Fortigate firewall is a multi-VDOM, consisting of VDOM root and VDOM oob. VDOM oob is connected to a Fortiswitch through Fortilink. The Fortiswitch is configured with two VLANs, and all ports are set as access ports for either VLAN 20 or VLAN 30, with the exception of port 24, which functions as a trunk port. There are no available ports on the Fortiswitch. My question is how to configure port 15 on the Fortigate firewall to enable access to both VLAN 20 and VLAN 30 on the Fortiswitch. Thank you in advance as I await your swift assistance.

Setup Diagram

ebrlimaAnswer

Staff

So first, you need to either move port15 to vdom OOB or configure inter vdom links between vdom root and vdom OOB

About inter-dom link, refer to this: https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/317358/inter-vdom-routing-configuration-example-partial-mesh-vdoms

So your flow would be:

Port15 >>>> Vdom-link(root side) >>>>>Vdom-link (OOB side)>>>>Vlan20

Port15 >>>> Vdom-link(root side) >>>>>Vdom-link (OOB side)>>>>Vlan30

At root vfom you have to have bidirectional rules from port15 to vdom link and from vdom link to port15, and routing so traffic from port15 to vlans 20, 30 is forwarded to the gateway, which will be the ip address of inter-vdom link on OOB side.

At OOB vdom, you configure rules from inter-vdom link to VLAN20 and VLAN30, which are interface vlans on your firewall at OOB side.

Screenshot 2025-03-14 165248.png

Let me know if I can help with something else.

OmoyeleolaAuthor

New Member

Hi Lima,

I have a second challenge concerning the setup diagram provided below. In this diagram, VLAN 30 is designated as the out-of-band (OOB) management VLAN, with the corresponding OOB management network IP address being 192.168.30.0/24. Each device intended for management via the OOB network is connected to the management VLAN ports of the Forti-switch through their respective physical management ports, as illustrated in the diagram. My objective is to manage the Fortigate firewall B using its IP address, 192.168.30.10, which is configured on the physical management port. In pursuit of this objective, I attempted to configure the static route outlined below. However, I encountered an issue where the command SET DEVICE MGMT was not accepted, even after I had removed the management port from being designated as a dedicated port. Could you please advise on the most effective method to achieve my goal of managing the Fortigate firewall B through its management port?

edit 12

set dst 192.168.209.0/26

set gateway 192.168.30.1

set device mgmt

Setup Diagram2.jpg

Sign up

Login with SSO

Login to the community

Login with SSO