vlan creation question in Fortigate

Hello

If you have enough free ports you can use one port for each VLAN without need to create vlan interface on FGT, and on switch side leave the two ports as access ports.

This is better for throughput.

In case you have few free ports, use one physical link with multiple VLANs like your 3rd example.

all three settings will basically work :)

it depends onb what you need. If you need the same vlans but more then one physical port to connect switches then user option 2. If one port is enough use option 3.

Vlans in FortiOS are always threated as interfaces so you can simply use them as source or destination interface for policies or routes.

Vlan interfaces in FortiOS are always "tagged". This means traffic hitting the physical interface they are tied to that has a matching vlan tag will hit the corresponding vlan interface and all other traffic will hit the physical interface. Just like a vlan trunk on a switch would work.

For case 2 take precaution to avoid a loop, since the FGT will show the same MAC addresses from both ports. LACP can also be good solution.

Regarding the interface for switch IP use, if you mean for switch management I'd not waste a FGT port just to manage a single switch. Usually in corporate networks with good design there is a segment dedicated for management purpose, FGT can be connected to that network via a dedicated port to filter access to managed devices. But the solution for you depends on your existing environment and on what you need. My advice is not just to make it work, but to make the good design for both network and security.

Hi @piaakit1210,

Can you provide a network topology? I believe you are connecting internal4 and internal5 to 2 different switches? 

Regards,