Technical Tip: FortiGate Firewall Link Aggregation Configuration in Transparent Mode VDOM

[sbabu]

Description	This article describes how to configure Aggregate interfaces in a Transparent Mode VDOM in FortiGate firewall.
Scope	FortiGate Firewall, Multi-VDOM setup, Transparent Mode.
Solution	Enable VDOMs in the CLI using the following command.  config system global set vdom-mode multi-vdom end All users and admins will be logged out of the device when the VDOM mode is enabled. Upon logging in again, two new default VDOMs will be seen: Global VDOM and Root VDOM. By default, all of the interfaces will be assigned to the root VDOM. To create a transparent VDOM, go to System -> VDOM -> Create New -> Give a name to a transparent VDOM (refer to the image below). The newly created VDOM will still be in NAT mode. To change to transparent mode, follow the commands below.  show config system settings set opmode transparent set manageip 10.5.63.190/255.255.240.0 set gateway 10.5.63.254 end Once the VDOM is created, assign interfaces to the Transparent VDOM.  In this example, port4, port5, port6, and port7 were moved to the transparent VDOM.  Create an aggregate Interface by going to Network -> Interface -> Create new -> Name of the interface -> Select 802.3ad Aggregate as type.    In this example, port4 and port5 have been defined as a LAN aggregate interface, and port6 and port7 have been defined as a WAN aggregate interface. Based on requirements, it may be desirable to optionally create a Vwire policy. To do so, follow this step: Go to Network -> interface -> create new -> Virtual wire -> Define a name and select the created aggregate interfaces.  Now create a Vwire policy for these aggregate interfaces. Go to Policy & objects -> Firewall virtual wire policy pair -> Create new -> name the policy and configure it as per requirements. In the CLI:  show config firewall policy edit 1 set name "VVire policy" set uuid bee484cc-4840-51ef-d0f7-804f317bdcc7 set srcintf "LAN-Agg" "WAN-Agg" set dstintf "LAN-Agg" "WAN-Agg" set action accept set srcaddr "all" set dstaddr "all" set schedule "always" set service "ALL" set logtraffic all next end