Skip to main content
commercial
New Member
March 20, 2026
Question

How to connect same VLAN on FortiGate internal switch (ISF) and FortiSwitch VLANs?

  • March 20, 2026
  • 1 reply
  • 385 views

I stepped away from Fortinet for a while and am coming back to find that there still seems to be no real solution to connecting the internal switch ports and external (FortiSwitch) switch ports on the same VLAN. 

 

You'd think that once you setup FortiLink, attach a FortiSwitch, and start making FortiSwitch VLANs that those VLAN interfaces would be available to add to either a software switch or hardware (vlan) switch. It doesn't seem that is the case though... Instead, it seems the only way to share traffic between internal ports and external ports is to PHYSICALLY connect between them?

 

Is this really the best (only?) solution:

  1. Create virtual VLAN switch with VLAN ID of zero on Fortigate.
  2. Add all the ports you are going to use as members
  3. Create sub-interfaces for each VLAN ID that you are using on the network
  4. Designate a physical port on the firewall as the trunk
  5. Create a trunk port on the switch controller for the FortiSwitches
  6. Physically connect the internal (fw) switch trunk port to the FortiSwitch trunk port

I suppose if you had an HA fw pair you'd need to make an agg. interface for the trunk?

 

I've not yet tested this as I just came up with it and the firewall and switches are in different locations (hence the desire to use the internal switch ports).

1 reply

commercial
New Member
March 20, 2026

It would be awesome if future versions of FortiOS would just treat the internal switches as if they were an external FortiSwitch. It would be far better to go to a single network management page that allows you to create all the VLANs, DHCP servers, DNS servers, NTP servers, then you just push them out to the switches, whether internal or external.  It is really annoying and awkward to go looking for DHCP settings buried deep inside the interface. Further confusing is the DNS servers have their own page/menu that allows you to add it to an interface, same with NTP server, but that is hidden under system settings...  The whole UI really needs a rework as it's only had marginal improvements over the decade.

Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT