Skip to main content
boxan
boxan
New Member
March 14, 2018
Question

Configure InterVLAN routing and subinterfaces

  • March 14, 2018
  • 3 replies
  • 41993 views

Good afternoon! I am the owner of FortiGate600D. FortiOS 5.6.2.

 

First question.

I'm interested in how can I configure InterVLAN routing? Is it possible to organize it the same way as at Cisco?

 

For an example on Cisco

 

Switch # configure terminal Enter configuration commands, one per line. End with CNTL / Z. Switch (config) #interface Vlan2 Switch (config-if) #ip address 10.1.2.1 255.255.255.0 Switch (config-if) #no sh

 

Next, a route appears in the routing table. How to do it in FortiGate 600D?

 

Second question.

How to create multiple subinterface on the interface?

For an example in cisco

interface FastEthernet0 / 0.146 encapsulation dot1Q 146 ip address 155.1.146.6 255.255.255.0 end

Whether it is possible to make such in FortiGate? I'm sure it is, but I can not find it in any manual?

Thank you in advance.

Sorry for my English.

    3 replies

    Saba1989
    Saba1989
    New Member
    March 14, 2018

    hi boxan

    if you have MLS cisco switch or cisco router it is better to do intervlan routing in MLS cisco switch, because you can do intervlan routing just by "intervlan routing".

    but in Fortigate you should weite a lot of policy to doing intervlan routing , for example if you have 3 vlan , you should write 6 policy to access all vlan to each other

    1 -->2

    2-->1

    1-->3

    3-->1

    2-->3

    3-->2

     

    about subinterface, fortigate do not have sub interface but it has vlan, loopback and ... type of interface

    romanr
    romanr
    New Member
    March 14, 2018

    zeynab wrote:

    hi boxan

    if you have MLS cisco switch or cisco router it is better to do intervlan routing in MLS cisco switch, because you can do intervlan routing just by "intervlan routing".

    but in Fortigate you should weite a lot of policy to doing intervlan routing , for example if you have 3 vlan , you should write 6 policy to access all vlan to each other

    Hey,

     

    sorry - but this is bullshit. If you want a Firewall to do Inter VLAN routing - than there is a reason for it. In most cases Internal Segmentation.

     

    Inter VLAN routing will happen automatically if you use Zones and put all interfaces into the according firewall zones. For the rest you will have to make policies for the traffic between those zones.

     

    For a typical 600D deployment, you will most probably create a LACP interface from the 2 10G interfaces and put all your internal VLANs on that LACP. Then put your zones together and create firewall rules between the zones for your internal segmentation.

     

    You should have a look into the cookbook: http://cookbook.fortinet.com/using-zones-to-simplify-firewall-policies-56/

     

    Br,

    Roman

    ericli_FTNT
    Staff
    ericli_FTNT
    Staff
    March 16, 2018

    boxan wrote:

    First question.

    I'm interested in how can I configure InterVLAN routing? Is it possible to organize it the same way as at Cisco?

     

    For an example on Cisco

     

    Switch # configure terminal Enter configuration commands, one per line. End with CNTL / Z. Switch (config) #interface Vlan2 Switch (config-if) #ip address 10.1.2.1 255.255.255.0 Switch (config-if) #no sh

    config system interface

    edit vlan2

    set vdom xxxx

    set ip 10.1.2.1/24

    set interface XXX

    set vlanid 2

    next

    end

    Also you could create more than one sub-interface under physical port "XXX".

    ericli_FTNT
    Staff
    ericli_FTNT
    Staff
    March 16, 2018

    boxan wrote:

    Second question.

    How to create multiple subinterface on the interface?

    For an example in cisco

    interface FastEthernet0 / 0.146 encapsulation dot1Q 146 ip address 155.1.146.6 255.255.255.0 end

    Let's say you create a sub-interface on the physical port "port10":

     

    config sys int

    edit vlan146

    set vdom root

    set ip 155.1.146.6/24

    set vlanid 146

    set interface port10

    end

     

    nbctcp
    nbctcp
    New Member
    October 6, 2020

    FIAGRAM: CISCO L3 SWITCH > FORTIGATE > WAN INTERNET fortigate port1 WAN directly connect to Internet fortigate port3 connect to Cisco switch   WAN SUBNET=10.0.10.0/24 port1 vlan10 DMZ SUBNET=10.0.20.0/24 port2 vlan20   CompanyA config sys int edit vlan100 set vdom CompanyA set ip 10.0.100.1/24 set vlanid 100 set interface port3 end   CompanyB config sys int edit vlan200 set vdom CompanyB set ip 10.0.200.1/24 set vlanid 200 set interface port3 end   REQUIREMENTS: -each vdom has its own sub-interface   QUESTIONS: 1. is my fortigate vdom sub-interface correct 2. do I need to create cisco port connected to fortigate port3 as trunk port to accommodate VLAN100 and VLAN200 in port3 sub-interface

     

    UPDATE1: -I think explained here

    https://docs.fortinet.com.../cookbook/402940/vlans

    https://kb.fortinet.com/k....do?externalID=FD31639

    Terms & ConditionsAccessibility statement