Source Interface Selection

6 replies
3282 views

Hi

I have port1 (LAN) and created 10 sub-interfaces for Vlans. So in Source interface selection box on all fortigate configuration, should I select Port1 or should I select Vlan interfaces?

FortiGate

Debbie_FTNTAnswer

Staff & Editor

Hey rezafathi,

you have multiple options:
- you can add all 10 vlans to a zone (but then you can only use the zone interface for policies)

- you can create 10 policies, one for each VLAN

- you can enable 'Multiple Interface Policy' under System > Feature Select to allow adding more than one source interface in a policy

-> please note that this will disable the interface-based view in GUI! Policies will no longer be sorted by source/destination interface, but instead by their configured order only.

mhemambika

Staff

Dear @rezafathi,

when you create VLAN interface on the firewall, VLAN interfaces will be becoming your logical interfaces for policy inspection, so in the source interface section of firewall policy, you will need to select the VLAN interfaces in order to control the traffic(received on the VLAN interface) based on firewall policy.

Hope this helps!

rezafathiAuthor

Explorer III

Thanks. in firewall policy I can only select one incoming interface but multiple sources. So if i want to give 10 vlans internet access what should I do?

Debbie_FTNTAnswer

Staff & Editor

Hey rezafathi,

you have multiple options:
- you can add all 10 vlans to a zone (but then you can only use the zone interface for policies)

- you can create 10 policies, one for each VLAN

- you can enable 'Multiple Interface Policy' under System > Feature Select to allow adding more than one source interface in a policy

-> please note that this will disable the interface-based view in GUI! Policies will no longer be sorted by source/destination interface, but instead by their configured order only.

mle2802

Staff

Hi @rezafathi,
It depends where traffic comes from. You can use sniffer to see incoming interface and use it as source interface. To sniff traffic, use this command " diag sniffer packet any "host X.X.X.X" 4 0 l ".

Regards,
Minh

Sign up

Login with SSO

Login to the community

Login with SSO