Skip to main content
fl0at0xff
fl0at0xff
New Member
October 10, 2016
Question

Basic question about VLAN design

  • October 10, 2016
  • 1 reply
  • 8329 views

Hello,

 

I just have a basic question: When you configure a Fortigate, what is the best practice regarding the configuration of VLAN ? For example, imagine I have 5 different VLAN in my network, I want to make the inter-vlan routing with the fortigate, how can I configure the interfaces ?

- It is better to create 5 vlan-interface under only one physical interface

- It is better to create 5 vlan-interface under 5 physical interfaces (one per vlan)

- It is better to use 5 physical interfaces as access interfaces ?

 

Thank you for you answers

1 reply

Somashekara_Hanumant
Staff & Editor
Somashekara_Hanumant
Staff & Editor
October 10, 2016

Hello,

 

- It is better to create 5 vlan-interface under only one physical interface

>>> Yes you can configure 5 VLAN interfaces on only one physical interface

 

- It is better to create 5 vlan-interface under 5 physical interfaces (one per vlan)

>>> You can configure each VLAN on different physical interfaces, advantage of multiple VLAN's on multiple interfaces is bandwidth

- It is better to use 5 physical interfaces as access interfaces ?

>>> This option also similar to the above option, you will be dividing the bandwidth on 5 interfaces,

 

Please refer the below documents also.

 

http://help.fortinet.com/...%20in%20NAT%20mode.htm

 

https://www.youtube.com/watch?v=NVLDRHLWbWc

 

Cheers

Somu

fl0at0xff
fl0at0xffAuthor
New Member
October 10, 2016

Hello and thank you for your answer.

 

Ok for the bandwidth argument. I understand the added-value tu use separate interface.

Now, when is it preferable to create one VLAN sub-interface per physical interface and when use directly the physical interface. Does it depend only of the configuration of the switch on the other side ? 

Nils
Nils
New Member
October 10, 2016

I would prefer to use Link Aggregation.

Aggregate several physical interfaces and then create vlan interfaces under the logical bundle.

But this is only supported on series above 100D(?).

 

Otherwise I would say that if you think you'll create new networks in the future, its better to go with VLAN intefaces. Then it's easy to just add a vlan to that interface and configure an IP-address without having physical access to the firewall.

 

Terms & ConditionsAccessibility statement