Technical Tip: Multiple VLANs in FortiGate with same MAC address

[nevan]

Description	This article describes why multiple VLANs in FortiGate can have the same MAC address, the reason behind the behavior, and limitations.
Scope	FortiGate.
Solution	In FortiGate, multiple VLAN interfaces can share the same MAC address, especially when they are created under the same physical interface. By default, VLAN sub-interfaces inherit the MAC address of their parent interface and FortiGate does not assign unique MAC addresses to the VLAN interfaces bind to a specific interface. VLANs on the Same Physical Interface: When multiple VLANs are created under the same physical interface they assign the MAC address of the physical interface. VLANs on Different Physical Interfaces: If VLANs are created on different physical interfaces, they will have different MAC addresses because each physical interface has its own unique MAC. Change of MAC address scope: In FortiGate, the MAC address of a VLAN interface cannot be manually changed. VLAN subinterfaces automatically assign the MAC address of their parent physical interface, and FortiGate does not provide an option to modify it. In this case, if the same Mac address creates layer2 conflicts the following workarounds can be followed: Use Different Physical Interfaces. Enable Independent VLAN Forwarding. Use a FortiSwitch for VLAN Handling. Use Virtual Wire Pair (VWP) or Transparent Mode. Use enhanced MAC VLAN interface the same way as normal VLAN interfaces Related documents: Technical Tip: vlanforward interface parameter Configuring VLANs(FortiSwitch) Technical Tip: Virtual Wire Pair (VWP) and connectivity with Non-VWP interfaces Enhanced MAC VLAN - FortiGate administration guide 7.4.7