Separate LAN hosts

Hello,

thanks for your reply.

I also thought this could not be possible, but i have found this in the thread i mentioned:

I have this kind of setup on one of my boxes. I believe this is refered to as a VLAN translation setup. Here is a quick simplified overview... You have your "normal" unsecured, everything else VLAN. You then also have one or more "secured" vlans depending on your segregation needs. You have a fortigate operating in transparent mode connected to a switch. On that switch, you have devices plugged into ports that are ONLY allowed to use one vlan. So your users and upstream routers are connected to vlan 1, a web server on vlan 2, and database on vlan 3 (for example). The web server switch port is only allowed vlan2, the database port is only allowed vlan3, and all other ports are only allowed vlan1. You then have your fortigate plugged into the switch on a trunk port that is allowed vlan 1, 2, and 3. You create rules that state users can connect from vlan1 to vlan2 to the web server on appropriate ports. The web server can connect to the backend database from vlan2 to vlan3 on appropriate ports, but users on vlan1 cannot talk to the database due to an implicit deny. What happens is that in transparent mode- the firewall will advertise mac addresses across all interfaces. So your web server on vlan2 cannot see any other devices because only it and the firewall sit on vlan2. The firewall advertises that it has routes to all other mac addresses on the local network and therefore traffic can flow. The same holds true in reverse for users to get to the web server as long as appropriate firewall policies are in place. Doing it this way allows you to scale your setup as you can just add more ports to the secured vlan and protect more servers behind the firewall without every changing any ip settings. The caveat is that the machines on the same vlan have unrestricted access to each other and you will eventually need aggregated interfaces to make sure you have enough throughput. You can also do this in a cheap fashion by directly connecting the devices to the physical interfaces on the firewall and forgetting about vlans- but it doesn't scale.

I hope there is a way to configure such a scenario.

I have tried to rebuild the scenario on the description, switch trunk port, configuring the vlans on transparnet Fortigate VDOM and adding policies. 

Maybe i misunderstood something, or the Fortigate behaviuor is different in the FortiOS releases (disabeld feature by default in newer OS?).

I have also seen a KB article which mentions "remapping VLAN IDs" with forwarding domains.

[size="2"]http://kb.fortinet.com/kb/documentLink.do?popup=true&externalID=FD32877&languageId=[/size]

I know, changing the IPs from hosts would be best solution, but this is not possible for different reasons :(

Regards

Marc