Manage many internal subnets

Question

Hi,   We just purchased a new FortiGate 100E for HQ and FortiGate 60E for Branch, logs will be sent to a new Analyzer 200F also at HQ. The current network has no Firewalls and routing/subnets is handled by MikroTik isp Router. Dhcp is handled by another MikroTik router that is behind the ISP router. There is also an ipsec vpn site to site link between two MikroTiks. All subnets and vlans share the same switches.  I want to manage everything from the FortiGates except Voice.  We have quite a number of different subnets at HQ that I want to know which is the best way to configure this on the FortiGate.   10.1.0.x/24, This is the native Lan at HQ which consists of all the staff devices and servers and is limit on IP's available. I configured a physical interface for this. All devices will receive dhcp ip and will be reserved with mac reservations and address groups. 10.2.0.x/24 This is the native Lan at Branch site and falls under another MikroTik Router linked with ipSec vpn between sites. I will set this up on the 60E as the main interface and link to HQ with ipsec vpn between 100E and 60E gates. 10.3.0.x/24 This is another subnet at HQ which only contains 3 VMware Hosts and a Vcenter server. No Vlan (I am planning on moving them into the 10.1.0.x/24 range) 10.4.0.x/24 This subnet contains all our access points at HQ which is statically configured and no vlan.(What do I do with this on this fortigate? I want only admin source IP's to access and manage these from range 10.1.0.x/24) 10.5.0.x/24 This is for the staff wireless network and on vlan 50. I configured a vlan under physical interface 10.1.0.x on the 100E. I want devices on here to be able to communicate with range 10.1.0.x/24. How will I go about doing this in the best way? Devices on here will be reserved with mac reservations and dhcp is on. 10.6.0.x/24 This range contains all our switches, 22 of them all static interfaces.  10.7.0.x/24 This is the Guest wireless vlan 60 range. Dhcp is on and I will configure this to be isolated. Created vlan under 10.1.0.x/24 interface. 10.8.0.x/24 This contains all our printers and CCTV cameras, all static. I want to move the printers perhaps to another range and keep CCTV on this range, I want to use untagged PVID access ports on the Cisco switches to completely seperate this network from the rest of the networks and will use another interface on the 100E Gate. Also remote access will be set up to this interface to access CCTV. 10.10.0.x/24 This is the 3CX Voice vlan 5. I want to create another vlan under 10.1.0.x/24 interface with dhcp for the phones. I do not want to manage the breakout and the ISP will MikroTik will still handle that. I want to also manage the phones from range 10.1.0.x/24.   So what I am confused with is what is the best way to manage all the other devices on different subnets by using the fortigate 100E. Will I just add a secondary ip address within those ranges so I can access the devices on there? Do I create policy routes? But which interface do I use then? Or must I create physical interfaces for all of them. I hope someone can clear up this confusion for me. Thank you

Toshi_Esumi · Answer

I would focus on physical paths to get to each group of devices you listed. Then let the switches do switching and cable management as much as possible. Since an 100E has enough ports, you could separate all to individual ports if you want, but I prefer combining them into fewer ports with vlans and connect them to switches then break them up using access ports before going out. Vlans are logical interfaces in a FGT so you can apply policy independently just like a physical port.

What I wouldn't do is secondary ips, which would mix up broadcast domains and create problems with DHCP servers and other issues.

Sign up

Login with SSO

Login to the community

Login with SSO