Skip to main content
fortimaster
fortimaster
Explorer III
June 6, 2024
Question

Route traffic using Fortiswitch, but witouth Inter VLAN Routing

  • June 6, 2024
  • 2 replies
  • 3298 views

Hi all ¡¡

I want to configure 2 stand alone fortiswitches, forming an MCLAG with ICL. Afther that, I want to define 3 VLANS, each one with a layer 3 address. For example:

 

192.168.1.1/24 Vlan 1

192.168.2.1/24 Vlan 2

192.168.3.1/24 Vlan 3

 

The fortiswitch will be configured with default route 0.0.0.0 0.0.0.0 192.168.1.2 (firewall) connected to VLAN 1.

 

Finally, I want these 3 Vlans can route traffic (using the static route configured) but , I don't want these 3 Vlans can route traffic between them witouth previously leave Fortiswitch.

 

For example, we have a server1 connected to VLAN 1, with IP 192.168.1.200/24 and default gateway 192.168.1.1 that wants to connect with server2 192.168.3.200/24 connected to Vlan 3 with default gateway 192.168.3.1.

 

The flow traffic that I'm looking for Layer 3 is:  SERVER1 --> FORTISWITCH --> ROUTER -->FORTISWITCH-->SERVER2

 

I have read about offload IP options, but Im not sure wether enable or disable it, the layer 3 of the switch could work this way. Maybe, another option to ge it could be using VRF ...

 

Thanks ¡¡¡

 

 

 

 

 

 

2 replies

xshkurti
Staff
xshkurti
Staff
June 8, 2024

You can check below links for more information:

Configuring layer-3 routing on FortiSwitch units | FortiSwitch Manager 7.2.4 | Fortinet Document Library

Layer-3 interfaces | FortiSwitch 6.4.2 | Fortinet Document Library

    fortimaster
    fortimasterAuthor
    Explorer III
    June 12, 2024

    Thanks for your help. It's not an usual scenary, I think the best way to achieve this will be using VRFs.

    ebilcari
    Staff
    ebilcari
    Staff
    June 28, 2024

    If you want to pass all the traffic for this 3 VLANs through the router, than technically you don't need this L3 interfaces in the switch. You can span the VLANs and have their gateways configured as sub-interface in the router.

    Emirjon
      jroy777
      jroy777
      Explorer II
      September 19, 2024

      Did you finally get this working? I have two Fortiswitches and the L3 Routing portion working with BGP back to Amazon AWS, But I am confused on the mclag portion. I have been unable to get any IP traffic from a host on any of the vlan's to cross the switch over to AWS hosts (layer2 to layer3?). I am looking at this and have not had success. Can you share some pointers?

      https://docs.fortinet.com/document/fortiswitch/7.4.3/fortiswitchos-administration-guide/811127/using-layer-3-routing-within-an-mclag#One-tier3

      fortimaster
      fortimasterAuthor
      Explorer III
      September 20, 2024

      Hi Jroy, I'm going to do that next week. I have not done it before because I was waiting for "advanced licenses" to can work with VRF and I have obtained them this week.

       

      I have another switches with MCLAG created working well, but ayone using dinamic routing protocol. If you want it, I can attach you the configuration from one of these MCLAGs but I'm not sure if it goes to help you. If you have problems, maybe is because you don't have advanced license to work well with advanced configurations.

        jroy777
        jroy777
        Explorer II
        September 20, 2024

        I have advanced license applied. The BGP is working on the Fortiswitch and I will revisit MCLAG at a later date. I would love to see your settings/configs when you get it completed :)

          Terms & ConditionsAccessibility statement