Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
khalavak
New Contributor II

FortiGate + FortiSwitch VLANs on both devices?

Hello,

first time poster here so have mercy :)

 

I am new to Fortinet but a long time security / networking administrator. I recently acquired a FortiGate 40F, FortiSwitch 108F and a FortiAP 221 to test it out and learn about Fortinet. 

 

I am running into a stupid problem that I can't understand: 

 

I would like to create VLANs on both FortiSwitch and FortiGate so that FortiGate is the gateway and DHCP-server on these VLAN networks. Furthermore, I would like to use the VLANs on the FortiSwitch so that I can use multiple ports on the switch on these VLANs, say port 1-4 has native VLAN accounting_VLAN and port 5-8 has VLAN printer_vlan, etc.

 

I would also like to use 1 or more ports on the FortiGate on these VLANs if needed. But this does not seem to be possible, to create a VLAN and then tag the VLAN on both FortiGate and FortiSwtich ports? 

From what I can see now, if using VLANs on the FortiSwitch, I can't use these VLANs on the FortiGate ports and use the FG ports for connecting devices to the VLANs that I use?

 

 

High Level overview of what I am trying to do:

 

1. Create VLAN accounting_VLAN(VLAN ID=10) and office_VLAN(VLAN ID=20) on FortiGate with IP-address and DHCP enabled etc. so that the Fortigate is the gateway for the VLAN network. 

2. Use the accounting_VLAN on FortiGate ports so that devices can be plugged into the FortiGate and assigned to one of these VLANs.(if FG-40F, then less ports to use, if 200F then more ports to use)

3. Connect FortiSwtich to FortiGate using Fortlink.

4. Trunk the accounting_VLAN on the trunk to the FortiSwitch

5. Use the accounting_VLAN ports on the FortiSwitch, for example ports 1-8 on accounting_VLAN and ports 9-13 on office_VLAN.

 

However, this doesn't seem to be possible from my testing different configurations? I can create VLANs on the FortiSwtich and tag them as native VLANs on different ports, but I can't use those VLANs on the FortiGate for creating a firewall/gateway interface to those VLANs. 

 

What am I missing? 

 

Best regards,

Kim,

 

14 REPLIES 14
khalavak
New Contributor II

Update: 

When creating a FSW VLAN the "Create address object matching subnet" was checked by default.  So I tested to remove the object that was automatically created and then the VLAN "CLIENT" was available in the Software switch.  Quite weird experience and GUI logic to be honest, doesn't make it easy for admins to configure FGT and FSW devices this way :(

 

Hope this helps for all other people out there trying to do this pretty simple and normal setup on a Fortigate and Fortiswitch. ;)

Thanks for your help and insight here @sachitdas_FTNT ! 

Screenshot 2021-12-06 at 19.48.06.pngScreenshot 2021-12-06 at 19.47.57.png

Toshi_Esumi
Esteemed Contributor

From FGT's view (or config), Fortilink is one of hard-switches. You can see it in CLI under "config system virtual-switch". When a VLAN is in a hard-switch, the same VLAN can not be a member of other hard-switch or soft-switch.

boneyard
Valued Contributor


@khalavak wrote:

 

I would also like to use 1 or more ports on the FortiGate on these VLANs if needed. But this does not seem to be possible, to create a VLAN and then tag the VLAN on both FortiGate and FortiSwitch ports? 

 

 


perhaps an annoying question, but why?

i personally just say it isn't possible, even though im not 100% sure. once you go FortiSwitch you use the FortiSwitch and don't mix and match VLANs with the FortiGate for access.

khalavak
New Contributor II

Why? 

 

Well, now I have a FortiGate 40F so I don't loose too many ports, but if I get a bigger FortiGate with more ports, those ports can become virtually unusable when using FortiGate + FortiSwitch and that just feels wrong and stupid if i can't be done. :(

boneyard
Valued Contributor

yeah ok, i get your reasoning. Fortinet seems to be moving away from the FortiGate models with lots of interface in general is my observation.

 

and sure you waste some, but in general i don't see it as that much of an issue. i do understand your point, but i would accept just provide enough FortiSwitches for the access ports and build a large enough link aggregate between the FortiGate and the switches.