Skip to main content
kkriss81
kkriss81
New Member
February 20, 2019
Question

Fortigate and Fortiswitch - Vlans

  • February 20, 2019
  • 2 replies
  • 8322 views

Hi all.

I have a problem to proper configure FG and FS.

 

I have

 

iternet modem

   |

   | (vlan100)

   |

switch (cisco)

   |

   |(vlan100)

   |

switch (fortiswitch)

  |

  |(vlan100)

  |

fortigate

 

When I use Cisco SG-300 (instead Fortiswitch), and configure port to untagged vlan 100 every things works ok.

But when i change to Fortiswitch native vlan 100, thats not working.

I have fortilink beetwen FG(port7) and FS(port48).

Trunk beetween FS and Cisco SW works ok.

I use port 6(vlan100) on FS and port WAN1 on FG.

 

Vlan 1 is working ok, beetween FG(port1) and FS(port1).

 

What can be wrong?

FG v. 6.0.4

FS v. 6.0.2

FS managed from FG.

 

    2 replies

    gradius85
    gradius85
    New Member
    February 20, 2019

    Can you show the cisco config? Remember Cisco has different meaning for Untag Native vlan VS Access port. You can have untagged traffic going over your trunk port, which is not tagged; however, I am not fully understanding your issue, but I would like to help.

     

    When you say "remove switch for cisco" does that mean you remove the Fortigate switch that is behind the Cisco switch?

     

    Please sent the Cisco config of the switch ports you are using.

    kkriss81
    kkriss81Author
    New Member
    February 21, 2019

    Thanks for replay.

    gradius85 wrote:

    When you say "remove switch for cisco" does that mean you remove the Fortigate switch that is behind the Cisco switch?

     

    Now i have -> modem - cisco(sw) - cisco(sw) - Fortigate. I want change the cisco switch (connected to fortigte) to fortiswitch.

     

    Cisco port configuration where all is ok

    "interface gigabitethernet45

    description "uplink vlan 100" switchport trunk native vlan 100 !"

     

    Fortiswitch conf for this port

    edit "port6" set native-vlan 100 set igmp-snooping disable set snmp-index 6 next

    gradius85
    gradius85
    New Member
    February 21, 2019

    Do you need the 'trunk native vlan 100'? Can you get away with just an Access Port? Or do you have a need to see/tag all traffic except v100 traffic?

    gradius85
    gradius85
    New Member
    February 20, 2019

    When you say vlan from your "internet modem" - is the Modem tagging the traffic with vlan100 802.1q tags? Or are you just showing that you want that traffic to be part of vlan100?

    Terms & ConditionsAccessibility statement