Same VLAN under two physical interface communication

Forum|Forum|8 years ago
August 31, 2018
8 replies
17789 views

Hi,

I have a Fortigate firewall V.5.6 I need to have one of the VLANs to be working on two different physical interfaces as two different Backbones exist.

So does a config like the below config works? how can I make both sub-interfaces communicate?

config system interface edit "VLAN.50.port.1" set vdom "root" set ip 172.20.2.1 255.255.255.0 ---> for example set allowaccess ping set interface "port1" set vlanid 50 next edit "VLAN.50.port.2" set vdom "root" set ip ????????????? ---> what IP should be used here. set allowaccess ping set interface "port2" set vlanid 50 next

Thanks

Ysuf

Alexis_G

New Member

no ,, it doesnt

rwpatterson

New Member

The only way to do anything similar would be to trunk and aggregate ports. If your model is above a 100D-E, then you can do that, otherwise you cannot.

sw2090

SuperUser

with aggregating or trunking you would loose the individual interfaces so you could not have different Subnets anymore but the same vid.

If you just want to be able to communicate to/from vlan 50 you only need some policy to allow this.

Toshi_Esumi

SuperUser

By knowing the limitation of L2 interfaces, your only option is to aggregate two physical interfaces into one hard/soft-switch interface, create a vlan sub-interface on it if it needs to be tagged, then add a secondary IP/subnet to have two subnets on the same vlan interface. Then both sides should be routed each others.

eastcoastmatt

New Member

Just to follow up on this..if I have two access layer switches each with two vlans (A and B) on them, can I connect them to different physical interfaces of the Fortigate and use the same vlan on both physical interfaces? Or do I need to aggregate those to a distribution switch and then connect distribution switch to Fortigate (via trunk and likely aggregate port for density)?

So my setup would be something like: Switch1: VlanA and VlanB -> Fortigate port 1

Switch2: VlanA and VlanB -> Fortigate port 2

It don't see how this would work without a distribution switch, but wanted to confirm. Thanks

Toshi_Esumi

SuperUser

As I wrote, and others wrote too, before, the soft/hard-switch on the FGT acts as a distribution switch.

port1 --+

+--> AggInt1(soft or hard switch)

port2 --+

Then the same set of VLANs are shared between two physical port. And that's all any FGT can do for L2 switching.

Sign up

Login with SSO

Login to the community

Login with SSO