Created on 04-19-2013 06:10 AM
Created on 04-19-2013 09:35 AM
Created on 04-21-2013 09:33 AM
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
Created on 04-22-2013 07:34 AM
I am configuring one like you but I cannot make it work as well.
what is the Foritgate mode (interface or switch mode)? What is the port configuration on the core which connect to Fortigate?
For example - I have a core switch port is G0/1. Do I need to change this port to layer 3 port on the core switch?
Created on 01-05-2022 08:01 AM
You do not have to change your core switchport in a layer3 port.
You can create a dedicated Vlan and SVI (switch virtual interface). Just define a small network (/29 by example)
int vlan 99
ip address 192.168.99.1/29
! 192.168.99.1 will be your next-hop for your LAN networks on the FortiGate
int gi0/0 <= interface used for the Fortigate connection
switchport trunk encaps dot1q
switchport trunk allowed vlan 99
switchport mode trunk
ip route 0.0.0.0 0.0.0.0 192.168.99.6
! 192.168.99.6 will be configured on the FortiGate side
You will find some interesting informations about the VLAN tagged interface creation here:
System => Network => Create New
Type is Vlan
Select your FortiGate interface connected to your switch
VLAN ID: 99 in this example
IP/NETWORK: Manual / 192.168.99.6/29
Administrative access: PING (you can also add HTTPS and SSH if you want to manage your firewall using this interface)
Don't forget to add your LAN network static routes. In my example, your next-hop will be 192.168.99.1
This link could be useful: https://docs.fortinet.com/document/fortigate/6.4.5/administration-guide/626338/adding-a-static-route
The only thing left to do is to create a filtering policy to allow internet output.
Keep in mind in this topology, your intervlan trafic will not be protected by your firewall.
I have a slight preference for using layer 2 switches only and configuring layer 3 on the firewall.