Skip to main content
aunghtunoo
New Member
July 3, 2015
Question

I want to use Network Design by creating Vlan routing on Fortigate 200D. Possible or not ?

  • July 3, 2015
  • 3 replies
  • 8253 views

Hi everyone,

 

I want to use a network design as download link to redundancy to each Distribution Layer switches by only creating vlans (SVI or Int Vlan Routing method) on FortiGate 200D. Is it possible or not ?

You can see my requirement design in Attached.

 

Actually, when I testing vlans creation to use on two Etherchannel link to Distribution Layer Switches.

But Vlans can be created on fortigate however only can choose a vlan on one Etherchannel link otherwise cannot choose a vlan on both two Etherchannel link.

 

So, How can I use another way with redundancy design by creating vlans on fortiGate to Distribution Swithes ???

Pls suggest me how to design to my network by using vlans on fortigate.

 

Thanks so much all.

aunghtunoo14@gmail.com

 

 

 

       

    3 replies

    gschmitt
    New Member
    July 3, 2015

    For this it would be easiest to remove all policies beforehand

     

    If you want to distribute a VLAN among multiple interfaces you need to put them in a software switch.

     

    Go to System > Network > interfaces

    If your ports are listed individually skip ahead.

    If they are listed as something like "internal" remove all policies/dhcp/etc referencing them

    Right click the internal > Change Mode and select Interface instead of Switch

     

    Now you need to create software switches for your VLANs.

     

    If I understand your picture correct you want 2 different networks (internal and DMZ) with 2 switches each and redundant connections to the internal switches.

     

    Again in System > Network > Interfaces select Create New

    Name "Internal"

    Type: Software Switch

    Physical Interface Members: add at least 4 ports

    Configure the rest as needed

    configure an aggregated link (802.ad)

    (you could use this as VLAN_lan since it's techically VLAN ID1 default)

     

    Repeat this for "DMZ" but only add 2 ports

    (again, this is technically vlan_dmz with ID 1)

     

    Now select Create New

    Name: "vlan_LAN"

    Type: VLAN

    Interface: "Internal" (the one created above)

    VLAN ID: your VLAN ID (needs to match the switches)

    Configure the rest as needed and repeat for all other VLANs

    The DMZ VLANs need to have Interface: "DMZ"

     

    NOW at Policy & Objects > Policies > IPv4 you can create policies to allow access from/to the different vlans as needed, select the VLAN Interface names as Source/destination Interface

    emnoc
    New Member
    July 3, 2015

    For this it would be easiest to remove all policies beforehand

     

    It really depends. if he has the ports availability even if not the 2nd redundant member he could craft the new L3-subinterface and over that bundle.

     

    Than change the routing to accept traffic from the local vlans at the distribution layer AFTER creating the new policies. I've done this like a  thousand or more times.

     

     So if the gateways of vlan_wifi/lan/peripherals are on the distribution-layer switches  than this is cut and dry, if not than you have more work.

     

    FWIW;  one of the new trends is to enable lacp always even if it's with one member so if you later design or add redundancy in your configuration, you have less work. This is even true imho with lower end units that don't have a lot of ports to begin with. It's always easy just to add member #2 or #3 or #4 etc... after you have the based 803.ad or static bundle defined.

     

    Just keep in mind  the smaller SMB firewall models typically don't support  lacp/bundles YMMV

     

    gschmitt
    New Member
    July 3, 2015

    emnoc wrote:

    Just keep in mind  the smaller SMB firewall models typically don't support  lacp/bundles YMMV

    I think it's 110 and lower who don't support lacp

    The 200D supports it

    aunghtunoo
    New Member
    July 10, 2015

    I got have the solutions.

     

    I use Redundancy Type to interface to two downstream Distribution Switches.

    Then all vlans can pass through over these links that is simple for me.

     

    Thanks so much to all.