New Member

Question

Need help with VLAN setup on 40F

Forum|Forum|3 years ago
December 23, 2022
18 replies
17676 views

Hi All,

I am a Fortigate newbie and need some help. I have a 40F unit running FortiOS 6.4.10 and am trying to set up multiple VLANs on an 802.3ad aggregate interface consisting of physical ports 2 and 3. It is for internal use on my home LAN. Here’s what I’ve done so far:

Delete the Hardware Switch bonding ports 1-3 together (default configuration from Fortinet).
Set up port 1 as a dedicated Admin port on network 192.168.10.1/255.255.255.0 and running a DHCP server doling out IP addresses from x.2 to x.254.
Set up an aggregate 802.3ad interface consisting of ports 2 and 3 on network 192.168.5.1/255.255.255.0 and running a DHCP server doling out IP addresses from x.2 to x.254.
Set up multiple VLANs on the 802.3ad interface each with its own subnet and DHCP server and device detection enabled for MAC filtering.

I am trying to follow the guide on the Forti-OS-6.4.10-Administration.pdf guide starting on page 403 and stopped short of adding firewall addresses or security policies. I thought the DHCP servers should work and hand out IP addresses regardless of whether the firewall and security policies were set up. I tried to test this with both a PC and a Macbook using a physical RJ45 connection on port 2, but can’t get any IP addresses from the Fortigate. I have tried it with and without MAC detection and nothing seems to work.

Ultimately what I want to do is assign a reserved IP for each device on my network (by MAC address) grouping each type of device into its own VLAN (entertainment, PCs, servers, security, etc.) and controlling traffic so that the IOT type devices are on VLANs that can’t traverse my network and get to the server or other PCs but can only go to the internet.

I don’t know why I can’t get the DHCP servers to work. Any help or debug tips would be appreciated.

Thanks,

Chris

FortiGate

Show previous replies

Mohamed_Gaber

Explorer III

We need to discuss several points.

Why do you dedicate one port for management and lose it? On FortiGate, you enable the management services you need on each interface, can specify the administrator IP, and remove the default admin after you create a new one.

Your devices do not support tagging; so, forget the VLAN now.

I see the secondary IP solution is near the case. In this case you should configure the IP provided to each MAC according to the subnet required. There is an issue. They could see each other with the applications that run over layer 2 directly and do not rely on IP.

chrisn7599Author

New Member

Hi Mohamed,

Thanks again for your insight and patience. I will forget about the VLAN since I don’t have a switch or WiFi mesh capable of tagging. I will opt for assigning IP addresses by MAC into various ranges depending on the type of device (servers in one range, TVs in another range, etc.). I will also add Port 1 back into the collection with Ports 2 and 3.

I’m not too concerned about layer 2 traffic provided I can set up sensible firewall rules. I think the Fortigate supports firewall rules by both IP and MAC – true?

What would you recommend regarding the network design at this stage?

Should I group Ports 1 through 3 into a Hardware Switch or an 802.3ad Aggregate interface?
What is the best way to set up the firewall rules to only allow certain devices access to the server and printers? Should this be done my IP address range or by individual MAC?
If I set up firewall rules by IP range, should I be concerned about attacks on layer 2 reaching my server or printers?
If I assign IP addresses by MAC via DHCP reservation, can I dump unknown MACs into a guest IP address range so that they can only access the internet and not my server or printers?

Thanks,

Chris

Toshi_Esumi

SuperUser

Read my previous comments. LAG/802.3ad is not an option if your switch doesn't support it. And in your setup it has no use either.

Mohamed_Gaber

Explorer III

If the WiFi could be connected to the 16-port switch, do that.

Deal each port as a separate subnet.

Let DHCP assign your device IP according to the MAC. Configure a dynamic DHCP range for guests. You could secondary IP to separate them also. FortiGate should be given IP in each subnet; either interface IP or secondary IP.

The layer 2 traffic on the switch does not go through FortiGate. To secure the servers connect them to a separate port.

The firewall policy is so much easy.

Configure address objects for each device and subnet. You could create address groups and add objects (in the same subnet) with similar permissions to it. Dealing with groups is easier as it could be modified (add or remove objects) later.

Next, create a policy from the incoming interface, and the outgoing interface; then select the allowed group as the source. You could restrict the destination if it is required.

Mohamed_Gaber

Explorer III

I am waiting for the happy news.

I see that you start. When you are in touch, you will see with your eyes and recognize with your mind.

Go and do it trusting your knowledge and your power.

Good luck.

chrisn7599Author

New Member

Hi Mohamed,

Thanks for the advice and encouragement. I have deleted the Aggregate 802.3ad interface I had set up and went back to using a Hardware Switch. Currently it only has Ports 2 and 3 in it but I will eventually add Port 1 back into it. I don’t just want to hang the server off of Port 3 because I also have a backup server and printer I want to isolate as well. I also have a printer that hangs off of the WiFi mesh I want to protect. That means, I need to be able to not care which physical port on the FG something is plugged into. I would rather simply control them using firewall rules by IP address range.

As such, I had planned to assign IP addresses based on MAC detection. I tried that using my laptop and it works great. For example, I reserved 192.168.2.69 to my laptop’s MAC, and when I plugged the laptop into Port 3 and requested an IP address, the FG’s DHCP server handed me 192.168.2.69. Therefore, I should be able to follow suite with my servers, other PCs, TVs, printers, etc. assigning each one an IP address within the desired range by type.

However, I don’t know how to set up a guest IP address range to dump unknown MACs into. The implicit rule is to assign an IP to unknown MACs but I don’t see a way to restrict the range inside of the 192.168.2.x network. I am concerned that the DHCP server will just dole out the next available IP address instead of restricting it to, let’s say 192.168.2.200 to 192.168.2.250. For example, let’s say I have two servers, but want to reserve 192.168.2.10 to .20 leaving room for future servers. What keeps the DHCP server from giving the next unknown device the address of 192.168.2.17 instead of something in a predefined guest range?

Any ideas on how to do this?

Thanks,

Chris

gfleming

Staff

Hey Chris, please review my response here: https://community.fortinet.com/t5/Support-Forum/Need-help-with-VLAN-setup-on-40F/m-p/241552/highlight/true#M204868

You cannot do anything you want to accomplish if you only have a L2 unmanaged "dumb" switch.

A DHCP server only works in one broadcast domain. Your switch is one giant broadcast domain. There is no way to have a DHCP server in one broadcast domain issue different IP addresses in different subnets or ranges to different devices. You can reserve IP addresses based on MAC address but these IP addresses will all be in the same subnet.

As such there is also no way to have your FortiGate block or inspect traffic between your devices.

Mohamed_Gaber

Explorer III

Congratulations. I am happy that you went forward steps with success. You are the one in the site and you have the most vision for the needs.

First, you have to use end-point protection software to protect your devices.

Take a backup daily to be safe.

If your devices are fixed, give them IP manually. In this case you will limit the DHCP range to not include their IP addresses.

"I am concerned that the DHCP server will just dole out the next available IP address instead of restricting it"; I have the same doubt (I don't have enough experience to know. I hope you do the test and let's know.

If you have the IP addresses of your devices and the range of the guest DHCP, then you could an address object for each and configure a separate firewall policy for each group.

config system dhcp server
edit 3
set default-gateway 192.168.2.1
set netmask 255.255.255.0
set interface "Workstation"
config ip-range
edit 1
set start-ip 192.168.2.200
set end-ip 192.168.2.250
next
end
set dns-server1 8.8.8.8
next
end

gfleming

Staff

It will not work without a VLAN-capable switch.

Mohamed_Gaber

Explorer III

FortiGate includes a license for FortiClient. You could use it also.

https://www.fortinet.com/products/endpoint-security/forticlient

gfleming

Staff

FortiGate does not include a license for FortiClient. You can use free FortiClient VPN software with ForitGate but this is unlicense software for VPN connectivity only.

FortiClient EMS which provides endpoint protection is a paid software.

Mohamed_Gaber

Explorer III

FortiGate 30 series and higher models include a FortiClient free trial license for ten connected FortiClient endpoints. For additionally connected endpoints, a FortiClient license subscription must be purchased.

https://community.fortinet.com/t5/FortiClient/Technical-Tip-FortiClient-licensing-and-support/ta-p/196327#:~:text=FortiGate%2030%20series%20and%20higher,license%20subscription%20must%20be%20purchased.

chrisn7599Author

New Member

Hi All,

Thanks for all of the input. I have learned a tremendous amount from all of you and you have cleared up many misconceptions I had about what the Fortigate is capable of and how it works.

At this point, I’m going to take a step back and search for an inexpensive managed switch that can do VLAN tagging to replace the dumb switch I currently have. I plan to set up a VLAN on each physical port of the new switch and multiple VLANs on one of the ports that I will plug the eero WiFi mesh into. I have already checked and I can ping and ARP devices hanging off of the WiFi mesh such that I can see each one’s MAC, so I know the frame is not being stripped of the MAC.

I have scoured the web and found an example of someone doing the very thing I am trying to do. See here: https://www.reddit.com/r/PFSENSE/comments/mzhfnp/good_mesh_wifi_solution_for_pfsense_which/

He is using a Netgear GS308T, an 8-port managed switch that does the VLAN tagging. Netgear also has similar managed switches with more ports that I will be looking into. Here is the 24-port version’s user manual: https://www.downloads.netgear.com/files/GDC/GS324T/GS324T_GS324TP_GS348T_UM.pdf?_ga=2.228157013.978222611.1672511917-848963566.1672511917

On page 131 of the guide, they explicitly show you how to configure the ports for MAC based VLAN tagging.

With respect to the guest network, I plan to disable it on my eero WiFi mesh and enable it directly on the AT&T router which will exist on the WAN side of the Fortigate. This moves the guest network outside of my LAN and allows me to dedicate the eero mesh to only those devices whose MAC I know and authorize.

Does this look like a workable plan? Do you have recommendations or experience with Netgear, TP-Link, and other managed switches? The ones I’m looking at are ~$300 on Amazon, and I don’t want to spend more than that.

Thanks,

Chris

gfleming

Staff

Couple comments on your plan:

1. Not sure why you think you need a MAC-based VLAN in your environment? Once you have a VLAN-capable switch you just assign VLANs to ports and that should be all you need to do.

2. Be careful using yourAT&T router's guest WiFi as now you are going to have two distinct and competing wi-fi signals that are not communicating with each other. You risk interference issues and other concerns. It would be best to just have one AP broadcasting all of your SSIDs. The Guest network would just be another VLAN that is tagged on the switch and terminated at the FortiGate.

chrisn7599Author

New Member

Hi Graham,

I understand what you are saying when it comes to the devices plugged directly into various ports on the managed switch using RJ45 cables. The problem I’m trying to solve is the mixture of devices coming in over the eero mesh which would be plugged into a single physical port on the new switch.

Some of the devices coming in on the eero have no easy way of setting their IP address statically, like the Ring camera, the Rainbird water sprinkler controller, the refrigerator, etc. I need to be able to put those types of IOT devices in a separate VLAN to restrict their access and assign an appropriate IP address to them via DHCP. Other things coming in over the eero, such as my wife’s PC, her iPad, our iPhones, and her printer need to be able to traverse the LAN. I can assign a static IP to the PC and the printer, but I don’t know that this is possible with the phones or iPad. Since I know the MAC address of everything on my network, I thought a MAC-based VLAN would be the best approach with DHCP servers running on each subnet/VLAN.

Then there is the matter of the guest network. While the eero has two SSIDs (privileged and guest), I don’t know how the switch would know whether a device was connected as privileged or as a guest. When I have friends over that want to jump on the WiFi, I don’t know their MAC addresses and need an easy way to restrict their traffic. Here are my use cases:

I need to be able to have trusted devices on the LAN that come in through hard wired connections to the switch and others that come in over the eero WiFi mesh.
I need to be able to restrict untrusted IOT type devices that come in over the eero WiFi mesh.
I need a separate guest network where devices come in over the eero WiFi mesh.

I am open to suggestions at this point with respect to the design. What is the best way to configure the network given the above use cases given the Fortigate, smart managed switch, and simple wireless access point attached to the switch?

Thanks,

Chris

Mohamed_Gaber

Explorer III

I am very happy for what you reached.

My advice is to keep login into the support forum and have a look at what people ask about. Once you learn and the other you reply and you enhance yourself.

Good luck

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded