Skip to main content
avilt
avilt
New Member
November 5, 2014
Solved

Fortinet Interface Selection WAN, DMZ

  • November 5, 2014
  • 3 replies
  • 8164 views

Is it mandatory that I chose WAN interface for Outside segment, DMZ interface for DMZ segment. Is there any hard coded settings such as security levels for these interfaces?

    Best answer by Paul_Dean

    They are labels for convenience. You can apply policies and virtual IPs to any interface.

     

    We had an early FortiGate 80C model which has two gigabit WAN ports and a fast ethernet internal switch. I turned the switch into interfaces and used the WAN ports as LAN ports. The internet connection is less than 100Mbps so it seemed like a waste to use a gigabit port. It's slightly confusing as it's still labelled WAN but you can use an alias.

     

    Check if the ports you want to use are connected to a network processor. This will speed up forwarding of packets by offloading sessions from the CPU after initial setup. Larger FortiGates use network processors. Small FortiGates have a system on a chip. Depending on your model and requirements this may affect the interfaces you want to use.

    3 replies

    Paul_Dean
    Paul_DeanAnswer
    Visitor III
    November 5, 2014

    They are labels for convenience. You can apply policies and virtual IPs to any interface.

     

    We had an early FortiGate 80C model which has two gigabit WAN ports and a fast ethernet internal switch. I turned the switch into interfaces and used the WAN ports as LAN ports. The internet connection is less than 100Mbps so it seemed like a waste to use a gigabit port. It's slightly confusing as it's still labelled WAN but you can use an alias.

     

    Check if the ports you want to use are connected to a network processor. This will speed up forwarding of packets by offloading sessions from the CPU after initial setup. Larger FortiGates use network processors. Small FortiGates have a system on a chip. Depending on your model and requirements this may affect the interfaces you want to use.

    avilt
    aviltAuthor
    New Member
    November 5, 2014

    That is a interesting point.

    I have a fortinet 200D model, how to know the ports that are connected to a network processor?

    I believe from the security point, I can use any for inside/outside connections. Am I right?

    emnoc
    emnoc
    New Member
    November 5, 2014

    All good points and unless your dealing with the bigger enterprised chassis and want to know what port are  bound to a ASIC ( i.e 3X40 ) than the port name is no revelant. FWIW I use my DMZ for a MPLS back and my DMZ is a 802.qq tagged subinterfaces off WAN2 .

     

     

     

    Paul_Dean
    Paul_Dean
    Visitor III
    November 6, 2014

    Yes you can use any for inside or outside connections.

     

    Have a look at the "get hardware npu" command. There are some options there which can display the NPU and which ports are assigned to it.

     

    http://docs-legacy.fortin...2520CLI/get.33.15.html

    Terms & ConditionsAccessibility statement