VLANs, Routing, and NATs

[keyesaw]

We are a K-12 school district, trying to VLAN our network.

The VLANs are setup on the switches, and interfaces for each have been created on the Fortigate.

We are using the Fortigate unit as the gateway for each VLAN.

We have a web filter in place, as well as a ISP load balancer. All units are VLAN-aware, and are configured.

I want to use the Fortigate as the main router for our district.

In the example, we have 4 VLANs.

Servers - VLAN 1

Teachers - VLAN 65

Students - VLAN 66

Public Wireless - VLAN 99

VLAN 1 clients/servers need to be able to access the internet.

VLAN 65 clients should be able to get to Server #1 (Port 80), Server #2 (Port 80), and the internet.

VLAN 66 clients should get to Server #2, and the internet.

VLAN 99 clients should only get to the internet.

If I set the gateway of the clients to their respective web filter gateway ( vs the Fortigate gateway ), they get to the internet fine, but are unable to access other servers.

I've messed with default static routes for eachs interface, a mix of static and policy routes, but I'm unable to satisfy what I want.

I'm having trouble getting this setup going - Any direction please?

Thanks!

I've attached a diagram.

[ede_pfau]

hi,

and welcome to the forums.

If I set the gateway of the clients to their respective web filter gateway ( vs the Fortigate gateway )

Why would you do that? The FGT is your router, not the web filter.

Point your clients' default gateway to the respective .1.1 FGT addresses. (Of course all other hosts should have the FGT as their default gateway as well, mainly the servers).

If the destination is internal (server #1 for instance), the FGT will route the traffic to it's VLAN1 port. If the address is unknown to the FGT, it will send it down it's own default route - the next hop address behind the FGT, the web filter appliance. Which then forwards it to the internet.

You'll notice that you won't have to declare static routes for all networks that are directly attached to the FGT, this is done automatically. The only route that needs to be set is the default route, 0.0.0.0/0, to the web filter's address.

If your clients are served by DHCP servers on the FGT then changing the gateway address is very easy.

[keyesaw]

Thanks for the reply. Setting the gateway to the upstream web filter was just a debugging technique. I'll want the gateway of the clients to be the Fortigate so I can do routing to other vlans. I need to to keep traffic separate all the way up to the firewall. (In their own vlan) So a wireless client's path: 10.99.2.1-> 10.99.1.1 - > 10.99.50.1 - > 10.99.50.5 Thanks!

[ede_pfau]

So now you've got the solution to your routing problem, right?

I don't see any question in your last post.

If you want to run e.g. the WiFi traffic in a VLAN of it's own even after the FGT then you'll have to assign a different VLAN ID to that traffic, from FGT to web filter. Can't see how this will enhance security but if that's your plan...no 2 FGT ports in the same network/VLAN.

[keyesaw]

Thanks for the reply.

 We need to keep traffic in it's own VLAN all the way up so our web filter is able to identify users.

I basically need to have a 'static route' for each VLAN / interface, but I can't seem to find a good way to do it. When I do policy routes, I'm unable to hit any firewall policies I have put in.

[keyesaw]

Anyone out there that can help?

 Basically I need each VLAN to have it's own static route for 0.0.0.0.

 Thanks!

[keyesaw]

Thanks!

It appears that this would solve the problem, but we would need more VDOMs that are available. Is there another method that anyone can think of that will push internet bound traffic upwards after checking all firewall policies/NATs?