Skip to main content
keyesaw
keyesaw
New Member
February 26, 2016
Question

VLANs, Routing, and NATs

  • February 26, 2016
  • 6 replies
  • 6949 views

We are a K-12 school district, trying to VLAN our network.

The VLANs are setup on the switches, and interfaces for each have been created on the Fortigate.

We are using the Fortigate unit as the gateway for each VLAN.

We have a web filter in place, as well as a ISP load balancer. All units are VLAN-aware, and are configured.

 

I want to use the Fortigate as the main router for our district.

 

In the example, we have 4 VLANs.

Servers - VLAN 1

Teachers - VLAN 65

Students - VLAN 66

Public Wireless - VLAN 99

 

VLAN 1 clients/servers need to be able to access the internet.

VLAN 65 clients should be able to get to Server #1 (Port 80), Server #2 (Port 80), and the internet.

VLAN 66 clients should get to Server #2, and the internet.

VLAN 99 clients should only get to the internet.

 

If I set the gateway of the clients to their respective web filter gateway ( vs the Fortigate gateway ), they get to the internet fine, but are unable to access other servers.

 

I've messed with default static routes for eachs interface, a mix of static and policy routes, but I'm unable to satisfy what I want.

 

I'm having trouble getting this setup going - Any direction please?

 

Thanks!

 

I've attached a diagram.

6 replies

ede_pfau
SuperUser
ede_pfau
SuperUser
February 26, 2016

hi,

 

and welcome to the forums.

 

If I set the gateway of the clients to their respective web filter gateway ( vs the Fortigate gateway )
Why would you do that? The FGT is your router, not the web filter.

Point your clients' default gateway to the respective .1.1 FGT addresses. (Of course all other hosts should have the FGT as their default gateway as well, mainly the servers).

If the destination is internal (server #1 for instance), the FGT will route the traffic to it's VLAN1 port. If the address is unknown to the FGT, it will send it down it's own default route - the next hop address behind the FGT, the web filter appliance. Which then forwards it to the internet.

 

You'll notice that you won't have to declare static routes for all networks that are directly attached to the FGT, this is done automatically. The only route that needs to be set is the default route, 0.0.0.0/0, to the web filter's address.

If your clients are served by DHCP servers on the FGT then changing the gateway address is very easy.

keyesaw
keyesawAuthor
New Member
February 26, 2016
Thanks for the reply. Setting the gateway to the upstream web filter was just a debugging technique. I'll want the gateway of the clients to be the Fortigate so I can do routing to other vlans. I need to to keep traffic separate all the way up to the firewall. (In their own vlan) So a wireless client's path: 10.99.2.1-> 10.99.1.1 - > 10.99.50.1 - > 10.99.50.5 Thanks!
ede_pfau
SuperUser
ede_pfau
SuperUser
February 27, 2016

So now you've got the solution to your routing problem, right?

I don't see any question in your last post.

 

If you want to run e.g. the WiFi traffic in a VLAN of it's own even after the FGT then you'll have to assign a different VLAN ID to that traffic, from FGT to web filter. Can't see how this will enhance security but if that's your plan...no 2 FGT ports in the same network/VLAN.

keyesaw
keyesawAuthor
New Member
March 1, 2016

Thanks!

It appears that this would solve the problem, but we would need more VDOMs that are available. Is there another method that anyone can think of that will push internet bound traffic upwards after checking all firewall policies/NATs?

Terms & ConditionsAccessibility statement
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!