Skip to main content
andrew_ang
andrew_ang
New Member
June 25, 2018
Question

Physical Interface LAN to Sub-interface VLAN switching on FortiGate 300D

  • June 25, 2018
  • 2 replies
  • 4449 views

Hi,

 

We're migrating to a new network structure but need to keep the old network for a couple more weeks. 

 

I have the following setup:

 

* port2 - 192.168.0.1/24 - physical interface

* port3 - 10.55.0.1/24 - physical interface

 

I need to create a tagged VLAN under port3 with VLAN ID 192, that is switched to physical port2.

 

I can't seem to find any resource on how to do this without changing much of the policies already in place for port2. 

    2 replies

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    June 25, 2018

    No, you can't do it since you have two different non-tagged subnets configured on those ports. If you need to have the same vlan across two ports, you need to create a hard/soft-switch, depending on the architecture of the model, to make them as a logical port.

    You need either a L2 switch doing it instead or the hard/soft-switch interface you combined them has both non-tagged subnets as a primary and a secondary subnet then create the vlan subinterface attached to it. In either way you need to collapse two ports into one.

    sw2090
    SuperUser
    sw2090
    SuperUser
    June 26, 2018

    This is a bit too few information ;)

     

    I assume you have the subnets like described plus one on the vlan (vlan interface on the FGT needs to have an IP too :) ). 

    The vlan is attached to physical port2 and is switched on from there.

    You want to be able to reach that vlan from port3. 

     

    As long as your clients in all three subnets use your Fortigate as default gateway then all you need is some additional policy that allows traffic from port3 to the vlan interface (and vice versa if required [i.e. if you want to reach port3 from out of the vlan]).

     

    The corresponding routes are already there since your FGT has an interface in each subnet - so it knows where to route the packets ;)

     

    Hope I got you right and it helps you

    Sebastian

    Terms & ConditionsAccessibility statement