Visitor III

Solved

SVI and Sub-Interface Configuration Using GUI

Forum|Forum|4 years ago
March 10, 2022
12 replies
15691 views

Q1 How do you configure a switch virtual interface and
do vlan tagging on the firewall ports using GUI?

Q2 If it is possible, pls do guide me and advice if I am supposed
to use a software switch or a hardware switch?

Q3 How come there can be 3 ip addresses for the physical
and virtual interfaces? Ip addresses should only be on the physical
or virtual interface, not both. (there are one physical and 2 virtual interfaces)

Q4 How do you configure an interface and assign sub-interfaces to it
using GUI?

FortiGate

Best answer by Toshi_Esumi

A1. Again no SVI. No way with FortiGates. FGTs are not "L2/L3 switch-router".

Toshi

sharmaj

Staff

Hello.

Please check this article here: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-create-a-VLAN-tagged-interface-802-1q-on-a/ta-p/193893

akristof

Staff

Hello,

Thank you for your questions.

Answer to your Q1 and Q3. Go to Network -> Interfaces -> Create New.

And there you have option to create different type of interfaces, for example Virtual-switch and hardware-switch (some options might be missing based on model, firmware, etc). Also, you have option to enable and configure secondary IP address to the interface.

Difference between Software-switch and hardware-switch is that not all devices have option to create hardware-switch. Purpose of hardware-switch is to bound together multiple hardware ports. Main difference is that traffic via hardware switch is possible to offload to ASIC, while software-switch process all packets via CPU:

https://docs.fortinet.com/document/fortigate/6.2.10/cookbook/100999/hardware-switch

And to answer your last questions. It depends what kind of sub-interface you want to create. For example, if you are creating VLAN, you need to specify to which parent interface this VLAN belong. If you are creating Ipsec tunnel, after you will configure it and if you configure route-based VPN, system will create tunnel interface, etc.

Network_EngineerAuthor

Visitor III

Hi,

So vlan is physical vlan?

Software switch is logical vlan?

I want to create router on a stick.

One interface have multiple vlan.

This is the subinterface I want to create.

How to do it?

akristof

Staff

Hey,

As my colleague share the docs, check this:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-create-a-VLAN-tagged-interface-802-1q-on-a/ta-p/193893

This will show you how to create VLAN on specific interface.

Vlan is not a physical interface and software-switch is not a logical vlan. Software-switch is switch.

Toshi_Esumi

SuperUser

BTW, with FortiGate architecture, "SVI" concept doesn't exist. All sub-interfaces are attached to their parent interfaces. The parent can be a single physical port, aggregated LAG interface, combined hard- or soft-switch interface. But never "float" with a VLAN tag.

Toshi

Network_EngineerAuthor

Visitor III

Good day,

Q1 Since there is no way to configure a logical vlan,

Is there any workaround for this?

Also I am still confused between software switch and vlan.

Q2 Isnt a vlan a virtual switch, so virtual switch is the same as software switch?

I am new to fortigate so please kindly clarify my questions.

Thank you.

akristof

Staff

Hi,

You don't need to use software switch. Usage for software switch is in specific scenarios. For example, you want to have your LAN and SSID working as a one interface. If you want to have Vlan, you create VLAN same as in guide and then firewall policy to allow traffic between interfaces.

Sign up

Login with SSO

Login to the community

Login with SSO