Technical Tip: How to tagged an untagged packet with FortiGate in transparent mode

[syao]

Description	This article describes how to tag an untagged packet with FortiGate in transparent mode in a Single or Multi-VDOM environment.
Scope	FortiGate v7.X.
Solution	This article assumes the network infrastructure in the following diagram is in place: ISP offers a VoIP solution and requires the IP phones to communicate over VLAN400. However, it has only one physical connection to the FortiGate (port1). The ISPs are using two VLANs: VLAN500 for Data (not shown in this example) and VLAN400 for Voice. The ISP is not aware that IP phones are connected to port3 of the FortiGate. These devices are not able to send VLAN-tagged frames and require DHCP to obtain an IP. This setup can usually be found in small offices/branch offices in which a VLAN-aware switch is unavailable. The FortiGate port3 interface is solely dedicated to the IP phones segment. This example uses a multiVDOM (NAT and Transparent) approach in which port3 and a VLAN interface are assigned to a dedicated transparent VDOM for Voice traffic. Convert the FortiGate (voice vdom) operation mode to transparent mode. config system settings set opmode transparent set manageip 192.168.1.10/255.255.255.0 end Create the VLAN interface and assign both interfaces (VLAN and port3) to the VDOM. Note: If multiVDOM is in use, the VLAN interface must be created from the 'Global'. config system interface edit "port3" set vdom "VOICE-VDOM" set type physical set alias "Connected to IP Phones" set snmp-index 3 next edit "VOICE_EXTERNAL" set vdom "VOICE-VDOM" set alias "Connected To ISP" set device-identification enable set snmp-index 9 set interface "port1" set vlanid 400 next end Configure firewall policy between the two interfaces: config firewall policy edit 1 set name "INTERNAL-EXTERNAL-VLAN400" set srcintf "port3" set dstintf "VOICE_EXTERNAL" set action accept set srcaddr "all" set dstaddr "all" set schedule "always" set service "ALL" next edit 2 set name "EXTERNAL-INTERNAL-VLAN400" set srcintf "VOICE_EXTERNAL" set dstintf "port3" set action accept set srcaddr "all" set dstaddr "all" set schedule "always" set service "ALL" next end Verification: DHCP Discover a packet captured from Port3 of the FortiGate: DHCP Discover a packet captured from the Port1 of the FortiGate: