Skip to main content
RJMcinty
RJMcinty
New Member
April 26, 2013
Question

Pairing 2 ports when in interface mode?

  • April 26, 2013
  • 5 replies
  • 6984 views
I' ve got a 40C running 4.0MR3, with the ports in interface mode. I' ve got 3 different zones physically isolated on 3 different ports, and they' re working fine with DHCP, isolation, routing, etc., which takes up 3 of my 5 ports. I' d like to take the other 2 ports, say, 2 and 3, and pair/bond/team them with port 1 so that they' re all part of the same subnet and can talk to each other, but I' m a bit of a noob, and stuck on how to do this. I could give each one an IP address on separate subnets, along with DHCP servers, and then set up firewall rules to open them up to each other. Or, perhaps I could just give them all IPs on the same subnet (say, 192.168.10.1, .10.2, and .10.3), use the same DHCP server on the .10.1, and then use firewall rules to open them up). But, I don' t know if there' s a more clever, better way to accomplish this. Thanks! Robert

    5 replies

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    April 26, 2013
    hi, no, no, nothing on Layer 3 necessary. You can combine ports on Layer 2, to form a " soft-switch" . The drawback is that all traffic between member ports will be handled by the CPU and not be accelerated. You can find a lot about this topic on the forum (search for " WiFi" or " soft-switch" ) and a description of the procedure in the FortiOS Handbook. Be aware that this will cost you some effort: in order to be available as a member port a port MUST NOT have any references to it. That is, be used in an address object, a route, a policy, a VIP, .... you get it. One way to do it is to back up the config, factory-reset the FGT, make the change (even then you have to remove some references), edit the config to reflect the new port name, and restore it. Sounds convoluted, and it is. Ports should be combined right at the start. But with patience it can be done.
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    April 26, 2013
    Now I see you' re working in interface mode anyway so you' ve changed the mode once before. So you know how to do it, just take the reverse path...
    RJMcinty
    RJMcintyAuthor
    New Member
    April 26, 2013
    Grrr. Thanks! That' s it exactly. The perf hit is disappointing, but understandable. I think that I can pretty easily make this change; I don' t think that I' m referencing any actual interfaces (other than the DHCP server); everything else is abstracted out. Not sure how I didn' t find this sooner. --Robert
    RJMcinty
    RJMcintyAuthor
    New Member
    April 27, 2013
    Well, that was anti-climatic! :) Downloaded the config file, edited with text editor to create the switch-interface, copied my config info from where internal1 was defined into the new interface config, and find/replace of internal1. One final question (for now!): I' ve got this going on: 
      config system switch-interface     edit " internal1_2"         set type switch        set member internal1 internal2  end  config system interface     edit " internal1_2"           set vdom " root"           set ip 192.168.xxx.xxx 255.255.255.0          set allowaccess ping https ssh http fgfm          set type switch     next     edit " wan1"       ...
    Do I need the " set type switch" in the config system interface section? I put it there because there was a " set type physical" when it was just internal1, and it seems to work, but want to make sure. :) Thanks!!! Robert
    RJMcinty
    RJMcintyAuthor
    New Member
    April 27, 2013
    It looks like it doesn' t matter whether the " set type switch" is in there or not; it always represents the type as " software switch" . Thanks! Robert
    Terms & ConditionsAccessibility statement