Fortigate Firewall 802.3ad Aggregate with vlans - "Zone" compatible?

Forum|Forum|2 years ago
May 27, 2024
3 replies
2003 views

Hello everyone :)

We have a Forti 200F Firewall cluster (HA A/P). It has two uplinks interfaces which are already combined in a zone. The downlink interface is an 802.3ad aggregate with two (X3&X4) members and several layer 3 vlan subinterfaces configured.

I now wanted to create a new zone with some of the layer 3 subinterfaces in it so I can simplify our rule creation.

However, when creating a new zone I can't see our aggregate interface and neither the subinterfaces for selection. Is this maybe not supported for zones? I can't find any explanation online. Thanks!

FortiGate

Hong_FTNT

Staff & Editor

Hi @ErrantOsi,

Those subinterfaces are under 802.3ad aggregate. You can't add it to other physical interface or zone.

Regards,

Brunn3r

Explorer II

If you have referenced a interface anywhere, you are not able to put it in a zone.
So you have to create a zone and leave it empty. Move the references (mostly Firewall-Rules) to this zone, then you should be able to add the interface into the zone.

Or at first, try it with a newly created test-VLAN.

Toshi_Esumi

SuperUser

I think those are just used by policies already. And that's why it wouldn't show up as member candidates. If you create a new VLAN on the LAG, it would show up to be added to the new zone.

Toshi

Sign up

Login with SSO

Login to the community

Login with SSO