Skip to main content
vanawful
vanawful
New Member
September 16, 2025
Question

vlan on multiple interfaces without IP

  • September 16, 2025
  • 4 replies
  • 589 views

I have an environment in which industrial switches (not fortiswitch) needs to be on the same mgmt vlan for all subnets. I am not finding a way to have the mgmt vlan passthrough on a foritgate with v7.6.x while also having the interfaces for the OT subnets.

Confused? Here is an example:

- Port WAN1: vlan 200 interface (main OT network), tag vlan1000 (mgmt) without creating interface

- Port 1: Contains vlan 801 interface

- Port 2: Contains vlan 802 interface

- Port 3: Contains vlan 803 interface

VLAN1000 must be tagged on Ports WAN1, 1, 2, and 3, without interface (passthrough). This is used to manage the managed switches.

This can be done on industrial firewalls from Siemens and Hirschmann. How is it done with Fortigate?

    4 replies

    Jean-Philippe_P
    Staff & Editor
    Jean-Philippe_P
    Staff & Editor
    September 19, 2025

    Hello vanawful, 

     

    Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

     

    Thanks, 

    Jean-Philippe - Fortinet Community Team
    AEK
    SuperUser
    AEK
    SuperUser
    September 19, 2025

    The only way I know is to create VLAN interface id 1000 on the related ports.

    AEK
      ebrlima
      Staff
      ebrlima
      Staff
      September 19, 2025

      FortiGate only performs vlan tagging if you create the interface vlan. One thing you can do is having an EMAC VLAN with the 1000 tag over each physical port. Like this:

       

      SPOKE # show sys interface | grep "vlanid 1000" -f
      config system interface
      edit "V1000-P3"
      set vdom "root"
      set type emac-vlan
      set role lan
      set snmp-index 17
      set ip-managed-by-fortiipam disable
      set interface "port3"<---
      set vlanid 1000 <---
      next
      edit "V1000-P4"
      set vdom "root"
      set allowaccess ping
      set type emac-vlan
      set role lan
      set snmp-index 18
      set ip-managed-by-fortiipam disable
      set interface "port4" <---
      set vlanid 1000 <---
      next
      end

       

      SPOKE # fnsysctl ifconfig V1000-P3
      V1000-P3 Link encap:Ethernet HWaddr 06:0C:29:FF:89:D9
      link-local6: fe80::40c:29ff:feff:89d9 prefixlen 64
      UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
      RX packets:0 errors:0 dropped:0 overruns:0 frame:0
      TX packets:7 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000
      RX bytes:0 (0 Bytes) TX bytes:746 (746 Bytes)


      SPOKE # fnsysctl ifconfig port3
      port3 Link encap:Ethernet HWaddr 00:0C:29:FF:89:D9
      link-local6: fe80::20c:29ff:feff:89d9 prefixlen 64
      UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
      RX packets:497098 errors:0 dropped:0 overruns:0 frame:0
      TX packets:14 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000
      RX bytes:35208840 (33.6 MB) TX bytes:1520 (1.5 KB)


      SPOKE # fnsysctl ifconfig port4
      port4 Link encap:Ethernet HWaddr 00:0C:29:FF:89:E3
      link-local6: fe80::20c:29ff:feff:89e3 prefixlen 64
      UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
      RX packets:497099 errors:0 dropped:0 overruns:0 frame:0
      TX packets:16 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000
      RX bytes:35208487 (33.6 MB) TX bytes:1708 (1.7 KB)


      SPOKE # fnsysctl ifconfig V1000-P4
      V1000-P4 Link encap:Ethernet HWaddr 06:0C:29:FF:89:E3
      link-local6: fe80::40c:29ff:feff:89e3 prefixlen 64
      UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
      RX packets:0 errors:0 dropped:0 overruns:0 frame:0
      TX packets:7 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000
      RX bytes:0 (0 Bytes) TX bytes:746 (746 Bytes)

       

       

      You can learn more about emac vlans on Fortigate here:

      https://docs.fortinet.com/document/fortigate/7.6.3/administration-guide/212317/enhanced-mac-vlan

        sjoshi
        Staff
        sjoshi
        Staff
        September 20, 2025

        you have mentioned that you have tagged vlan 1000 in wan1 without creating interface. Can you elaborate more how you have done it?

        Are you using native vlan?

        Thanks, Salon
        Terms & ConditionsAccessibility statement