Skip to main content
Sego
Sego
Explorer
June 4, 2024
Solved

Layer3 Fortiswitch

  • June 4, 2024
  • 3 replies
  • 4332 views

Hi all,

our current setup is FG 80f acting as a firewall and  NAT device with Layer3 switch  acting as a router for office network and intervlan routing.

We would like to replace current layer3 switch with 2 switches from Forti ecosystem that can act as redundant routers.

Requirements are as following:

L3 switch handles intervlan routing

L3 switch acts as a router for private networks

L3 switch/es supports HSRP or VRRP

FG80f handles NAT and traffic inspection

Switch and future Forti AP-s are managed via FG80f 

 

 

So basically i want central management for Forti network devices and L3 traffic between private networks to be handled on switches which are redundant gateway for client network devices.

 

Is that feasible ?

 

Regards,

Drazen

Best answer by AEK

Hi Sego

Starting in FortOS 7.4.1 with FortiSwitchOS 7.4.1, managed FortiSwitch units can perform inter-VLAN routing.
https://docs.fortinet.com/document/fortigate/7.4.0/new-features/369021/support-inter-vlan-routing-by-managed-fortiswitch-units-7-4-1

However I didn't test it and didn't read enough about it so I can't tell under which conditions it will work, i.e.: if it requires extra license or if it works for specific cases.

Also you may refer to FSW feature matrix to see which models support VRRP and inter-VLAN routing.

https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/142e9ce5-fc4c-11ee-8c42-fa163e15d75b/FortiSwitch-7.4.3-Feature-Matrix.pdf

Hope it helps.

3 replies

mahesh_pm
mahesh_pm
Explorer
June 5, 2024

Hi,

 

Some FortiSwitch models support MCLAG, enabling switch-level failover. By creating all VLANs on the FortiSwitch and establishing a default route to the FortiGate-connected interface, you can efficiently redirect internet traffic.

please check the link below.

 

https://docs.fortinet.com/document/fortiswitch/7.0.8/devices-managed-by-fortios/617590/mclag-peer-groups 

    AEK
    SuperUser
    AEKAnswer
    SuperUser
    June 5, 2024

    Hi Sego

    Starting in FortOS 7.4.1 with FortiSwitchOS 7.4.1, managed FortiSwitch units can perform inter-VLAN routing.
    https://docs.fortinet.com/document/fortigate/7.4.0/new-features/369021/support-inter-vlan-routing-by-managed-fortiswitch-units-7-4-1

    However I didn't test it and didn't read enough about it so I can't tell under which conditions it will work, i.e.: if it requires extra license or if it works for specific cases.

    Also you may refer to FSW feature matrix to see which models support VRRP and inter-VLAN routing.

    https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/142e9ce5-fc4c-11ee-8c42-fa163e15d75b/FortiSwitch-7.4.3-Feature-Matrix.pdf

    Hope it helps.

    AEK
      Sego
      SegoAuthor
      Explorer
      June 6, 2024

      Hi Aek, 

      so....

      Good thing is that interVLAN traffic no more needs to pass through FG, but bad news is that i must pay extra for that and also bad VRRP and rest of L3 goodies is available only in standalone mode.

      So, my setup could/would like this:

      1FG 80f in role of firewall, NAT, L3 router, VLAN termination with A and B ports connected to 2 Fortiswitches configured in MCLAG, interVLAN routing is supported ond FORTISWITCH 1024D and above with advanced feature licencom.

      Opinions are welcomed please...

       

       

      PS i forgot to mention that 10G from switch server load is highly welcome feature.

      AEK
      SuperUser
      AEK
      SuperUser
      June 6, 2024

      Hi Sego

      Besides, here I notice that you are using entry level FG with big sized FortiSwitches (1024D is data center series). I'm not saying it is wrong but for me such combination is absolutely not common.

      Except if it is for servers working together with very high load and connecting to internet with average bandwidth, then that would probably make sense.

      AEK
        Toshi_Esumi
        SuperUser
        Toshi_Esumi
        SuperUser
        June 5, 2024

        Probably you can't test&confirm it until you get FSWs if it can be done exactly what you want. But keep it in your mind at that time there is an option to make FSWs work in "standalone" mode so that you can keep the brain completely separated from your FG80F's for both L2 and L3 handling, just like you're doing with your current switches.

        Toshi

          Terms & ConditionsAccessibility statement