New Fortigate 70G setup question

The 70G has 8 ports for LAN and 2 for WAN.

In case you have 8 VLANs or less, then I suggest using one FG port for each VLAN, this is better to maximize the bandwidth.

Other possibility is to create LACP interface (e.g. with 4 ports) then create VLAN interfaces on it, this allows maximizing bandwidth and share the interfaces at the same time.

For management I think the good practice is to dedicate one physical port.

Short answer to your either/or: use 802.1Q VLAN sub-interfaces on the single trunk port. This is router-on-a-stick, and it is exactly what your existing setup is built for. Do not create a VLAN switch on the FortiGate, and do not go one-port-per-VLAN. You already have a trunk and your Cisco switches already do the access-layer switching, so the FortiGate just needs to be the tagged router on the end of that trunk. One-port-per-VLAN throws away the trunk you built, wastes ports, and does not scale. A VLAN switch on the FortiGate is for the opposite case, where you want the FortiGate's own ports to act as switch ports for directly connected endpoints, which is not your situation.

Quick hardware note: the 70G is 10 x GE RJ45, made up of 7 internal ports, 2 WAN ports and 1 DMZ port. There is no separate dedicated management port, so "dedicate one port for management" means dedicating one of the internal ports. Fortinet

Why it is not talking right now. This is almost always a tagging or native-VLAN mismatch. A FortiGate VLAN sub-interface is 802.1Q tagged. If you put an IP directly on the physical port, that traffic is untagged and only lands in the Cisco trunk's native VLAN, so it never matches your tagged VLANs. Check, in order:

• Cisco side: switchport mode trunk, switchport trunk allowed vlan lists every VLAN you want to route, and switchport trunk native vlan is set to a parking VLAN you do not use (do not leave it on VLAN 1).
• FortiGate side: each VLAN sub-interface VLAN ID matches the Cisco VLAN ID exactly.
• Make sure the trunk-facing physical port is a standalone interface, not still a member of the default LAN hardware/virtual switch. Remove it from that switch first, otherwise you cannot add VLAN sub-interfaces to it.

FortiGate config, assuming the trunk lands on internal port port3:

config system interface
    edit "VL20-DATA"
        set interface "port3"
        set vlanid 20
        set ip 10.20.20.1 255.255.255.0
        set allowaccess ping
        set role lan
    next
    edit "VL30-VOICE"
        set interface "port3"
        set vlanid 30
        set ip 10.30.30.1 255.255.255.0
        set allowaccess ping
    next
end

Repeat one sub-interface per VLAN. Each sub-interface IP is the default gateway for that subnet. Add a DHCP server per VLAN if the FortiGate is serving DHCP, then create a firewall policy from each VLAN to your WAN interface with NAT enabled, and a default route to the WAN gateway. Inter-VLAN traffic is controlled by separate policies, deny by default and open only what you need.

Matching Cisco trunk:

interface GigabitEthernet0/X
  switchport trunk encapsulation dot1q   ! older IOS only
  switchport mode trunk
  switchport trunk allowed vlan 20,30,99
  switchport trunk native vlan 99

Management. Since you want a dedicated management port, keep it off the trunk. Take a separate internal port, connect it to a Cisco access port in your mgmt VLAN, give it an IP, set allowaccess ping https ssh, and lock admin access down with trusted hosts so only your admin subnet can reach the GUI. That gives you clean physical separation between management and the data trunk, which is the safer design and matches what you described.

One habit worth adopting from the start: do not use VLAN 1 anywhere, and put management on its own VLAN. It saves you a lot of pain later.

Hi ​@sekinpetr 

The best approach is to configure the FortiGate 70G with VLAN subinterfaces on a single trunk port rather than using a VLAN switch configuration. Connect a FortiGate interface (for example, port2) to the Cisco switch configured as a trunk carrying all relevant VLANs, then create separate VLAN subinterfaces on that physical FortiGate port, assigning each one a VLAN ID that matches the Cisco configuration. Designate one of those subinterfaces as the management VLAN and assign it an IP address reachable from your admin workstations. Each additional VLAN subinterface can be tied to its respective internal network to control and route traffic separately. This topology allows for easy policy management and centralized routing between VLANs and the internet. Ensure the FortiGate interfaces are in the correct zones (e.g., internal, WAN) and that firewall policies are configured to permit the necessary traffic between them and the WAN for internet access