Skip to main content
0skarprez
0skarprez
New Member
July 22, 2020
Question

InterVLAN routing on L3 switch or Fortigate?

  • July 22, 2020
  • 1 reply
  • 5269 views

Hello everybody, I would like to know your opinions or what would be the best, for the following topic. 

I have to create a network for 40 users, just accessing basic services such file server, printers, internet and wifi. I have a Fortigate 60F and I am going to install L3 switch cisco 9300, and 2 access switches 2960. I want to create 5 data Vlans and one voice vlan. I also will have VPN connections trough SSL, and wifi Network in a different VLAN. My question is: where would you handle the interVLAN routing, in the L3 switch, or in the fortigate? thanks al for your advices

regards

    1 reply

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    July 22, 2020

    It's a question if you want/need to regulate (apply policies) inter-vlan traffic. If yes, it needs to come to the FGT before routed to another vlan. If not, let the switch inter-connect vlans and the FGT controls traffic only to/from the outside.

    lobstercreed
    lobstercreed
    New Member
    July 22, 2020

    No question in my mind.  If your firewall can handle the throughput (probably can, depending on the type of work being done), do the VLANs on the firewall.  You get layer 2 visibility into your whole network, which is nice for auditing and troubleshooting, but also allows you to write stricter policies (i.e. down to the device MAC address, not just the IP). 

     

    Also keep in mind it doesn't have to be all one or the other.  You may want to put your guest wifi VLAN on the firewall while leaving the rest of your network free to communicate.  You can also change this on a per-VLAN basis later fairly easily with very brief disruption to the network.

     

    - Daniel

    Terms & ConditionsAccessibility statement