100D - The truth about VLANs and Interfaces

[asgspl]

Hi Guys,

First post so please be gentle. :)

Long story short.

Plan is to use 100D as main device where I'm going to bring up my VLAN interfaces and have a L2 HP switch as the LAN switch.

Is it just me or it's really rocket science to do that CISCO style, which means:

On 100D have the last 2 ports(aggregated) trunk mode connected to 2 ports on my HP(obviously aggregated as well)

And know the confusion, where the hell I need to configure the VLAN sub interfaces("pour les connaisseurs I'm referring to cisco inter vlan routing on a stick). In the same time on the 100D I need to have some other aggregated interfaces part of different vlans.

I've read almost all the Fortigate docs and still have no idea how to do it.

Below a text diagrams of what I want to achieve:

[size="2"]100D [interface[802.1aq]-vlan 102]; [2nd interface[802.1aq]-vlan 102]; [3rd interface[802.1aq]-vlan 103]; [last interface[802.1aq] - trunk(carries all the vlans)[/size]

The question is the same, where do I configure the VLAN sub interfaces? 

If anyone can point me even to right docs or give some idea would be very appreciated.

Cheers,

Tony 

[asgspl]

Hi,

I've done my L3 VLAN sub interfaces on my LACP trunk connected to my HP switch. Everything is working fine including my inter vlan routing. Now, my last 2 ports (15&16) are bonded and configured as LACP Trunk allowing VLAN 100,101,102 and 103.

The issue I have is that I don't know how to untag another interface on my 100D into one of the mentioned VLAN's. Let's say I have a Server which I want to be connected to an interface(type 802.ad or software switch or VLAN switch) on my 100D and the interface to be untagged in VLAN 102.

Cheers,

T

[asgspl]

Hi Guys,

Maybe I wasn't clear what I want to achieve now, English - second language, dodgy sometimes.

If all my L3 subinterfaces are configured on my trunk link to HP switch like this:

- Main Interface 802.ad Trunk to switch (Port 15 & 16 on 100D)

- VLAN 3 subinterface - VLAN 100 - VLAN One    : 192.168.100.1/24

- VLAN 3 subinterface - VLAN 101 - VLAN Two    : 192.168.101.1/24

- VLAN 3 subinterface - VLAN 102 - VLAN Three  : 192.168.102.1/24

- VLAN 3 subinterface - VLAN 103 - VLAN Four    : 192.168.103.1/24

I want to achieve 2 thinks:

1. Add port 13 & 14 on 100D to VLAN Two and use the same ip range as above

2. Port 9 & 10 on 100D a Trunk port connected to a ESXi HOST so I can send my VLANs to my virtual switch port groups and again those VM's need to use IP's from the same ranges configured as L3 Sub Interfaces.

Thank you guys,

Cheers,

Tony

[Robin_Svanberg]

asgspl wrote:

Hi Guys,

Maybe I wasn't clear what I want to achieve now, English - second language, dodgy sometimes.

If all my L3 subinterfaces are configured on my trunk link to HP switch like this:

- Main Interface 802.ad Trunk to switch (Port 15 & 16 on 100D)

- VLAN 3 subinterface - VLAN 100 - VLAN One    : 192.168.100.1/24

- VLAN 3 subinterface - VLAN 101 - VLAN Two    : 192.168.101.1/24

- VLAN 3 subinterface - VLAN 102 - VLAN Three  : 192.168.102.1/24

- VLAN 3 subinterface - VLAN 103 - VLAN Four    : 192.168.103.1/24

I want to achieve 2 thinks:

1. Add port 13 & 14 on 100D to VLAN Two and use the same ip range as above

2. Port 9 & 10 on 100D a Trunk port connected to a ESXi HOST so I can send my VLANs to my virtual switch port groups and again those VM's need to use IP's from the same ranges configured as L3 Sub Interfaces.

Thank you guys,

Cheers,

Tony

Unfortunately, that´s not possible to configure on a Fortigate. You need to connect that through your HP switch or create new VLANs on the Fortigate for those systems to achieve that. 

You can create a switch in the Fortigate but all interfaces will get an identical configuration. I have never tried creating a software switch with a physical interface and 802.ad interface so don´t know if you can but even if it did I wouldn´t recommend it due to extra load the switch requires on the system.

We never connect any systems/devices directly to our Fortigates. You will get much better spanning-tree, loop-protection, aggregation, logging etc. on a switch than on Fortigate and if you would decide to go for an A-P cluster you don´t want to have system/devices connected directly to the Fortigate.

Robin

[asgspl]

Thanks Robin. Since the 100D is doing the intervlan routing, which I'm happy about because I can control traffic via the firewall policies, the only concern I had is that traffic needs to flow via the trunk between 100D and back to switch which are part of a diff vlan. I suppose I can add another 2 patch leads and do a 4 x 1Gb 802.ad trunk so I don't have bandwidth issues. Cheers, Tony