Created on
02-08-2010
11:56 PM
Edited on
10-02-2024
07:32 AM
By
Jean-Philippe_P
Description
This article describes how to configure software switches.
A software switch, or soft switch, is a virtual switch that is implemented at the software or firmware level and not at the hardware level.
A software switch can be used to simplify communication between units connected to different FortiGate interfaces.
For example, using a software switch, the FortiGate interface is connected to an internal network on the same subnet as the wireless interfaces.
Units on the internal network can communicate with units on the wireless network without any additional configuration on the FortiGate unit, such as additional security policies.
Scope
FortiGate.
Solution
A software switch can also be useful if it requires more hardware ports for the switch on a FortiGate.
For example, if the FortiGate has a 4-port switch, WAN1, WAN2, and DMZ interfaces, and one more port is needed, create a soft switch that can include the four-port switch and the DMZ interface, all on the same subnet.
These types of applications also apply to wireless interfaces, virtual wireless interfaces, and physical interfaces such as those in FortiWiFi and FortiAPs.
Similar to a hardware switch, a software switch functions like a single interface.
A soft switch has one IP address and all the interfaces in the software switch are on the same subnet.
Traffic between units connected to each interface is not regulated by security policies, and traffic passing in and out of the switch is controlled by the same policy.
To create a software switch from GUI:
To create a software switch from CLI:
config system switch-interface
edit <switch-name>
set type switch
set member <interface_list>
next
end
config system interface
edit <switch_name>
set ip <ip_address>
set allowaccess https ssh ping
next
end
Sample configuration: software switch
For this example, the wireless interface (WiFi) needs to be on the same subnet as the DMZ1 interface to facilitate wireless syncing from an iPhone and a local computer.
Because synching between two subnets is problematic, putting both interfaces on the same subnet the synching will work.
The software switch will accomplish this.
Merge the WiFi port and DMZ1 port to create a software switch named synchro with an IP address of 10.10.21.12.
Use the following CLI commands to create the switch, add the IP, and then set the administrative access for HTTPS, SSH and Ping.
config system switch-interface
edit synchro
set type switch
set member dmz1 wifi
next
end
config system interface
edit synchro
set ip 10.10.21.12
set allowaccess https ssh ping
next
end
When the soft switch is set up, add security policies, DHCP servers, and any other configuration that is normally used to configure interfaces on the FortiGate.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2025 Fortinet, Inc. All Rights Reserved.