This article describes how to setup a FortiGate unit in Transparent mode, in the presence of trunks containing multiple VLANs (802.1q tagged interfaces).
FortiGate units or VDOMs, configured in Transparent mode.
The following diagram illustrates this example:
It is assumed that the trunk is a single physical interface with VLANs 102 and 103.
The FortiGate unit must filter traffic from port2 to port3 and vice versa.
This article does not cover any aspects of content inspection (no protection profile).
Step 1: Create VLANs and forwarding domains
In order to avoid any L2 issue due to broadcast domain overlap and packets looping back on the trunk, assign each pair of VLAN interfaces into a unique forwarding domain. This will, for each VLAN, create independent broadcast domains on the FortiGate unit and confine all broadcasts and multicast traffic between the interfaces belonging to a same forward-domain.
Note that the forward-domain ID can be different to the VLAN ID, but it is recommend for troubleshooting and readability to keep them the same.
Step 2: Create the appropriate Firewall Policies
To verify if traffic flows or troubleshoot any issue, please refer to any of the methods described in the related articles at the end of this page.