Add VLAN sub interfaces to a fisical interface

[hgg]

Hi

Right now i have a network in production with no VLANS, a change in circunstances force me to create several VLANS to better segment our network and improve our security.

My question is:

Can i add VLAN Sub interfaces to our, currently in production, VLANless physical interface without consequences or should i create a new interface for the previous physical interface (for example as VLAN 1 or native) beside the new ones with the issues this will bring (DHCP among others)?

Thank in advance

[Toshi_Esumi]

I think I answered to your question on a different thread. Please avoid cross-threads for the same issue.

[hgg]

Hi Toshi

I ask you to forgiveme .

It is not quite the same question, this question is about leave everything as it is and add VLAN interfaces over my current interface.  The other question was about move a physical interface to a VLAN interface in a manner that do not require to rebuild everything.

Thanks for your comprension.

[ericli_FTNT]

Definitely you can but I'm wondering how did you configure the other end? If it's another Fortigate, it should be ok. If it's a switch, trunk or access mode?

[hgg]

All my network runs in the native (VLAN 1) VLAN in switchs HP.  This is something i need to change but i am affraid to do it over a production network with a bunch of devices.  I need that everything keep working while i'm implementing the VLANs.

This is the info you needed?

[ericli_FTNT]

Thanks for reply!

I understand all your network is running within native vlan. But if you need to create a new vlan interface, you need to make sure the port on your HP switch can accept it's vlanid. therefore, it should be in trunking mode.

[rwpatterson]

In your situation, I would create a second trunk interface, define all of your VLANs there, then move devices to the new VLAN (and trunk) after testing the link with a test device on that VLAN for connectivity. Once you are sure the switches route correctly to the 40gate, then flip the port (on the switch) that the server is on to the confirmed good VLAN. This can be done on a machine by machine basis. No big forklift overhaul and you don't affect the running environment until you move that single device.

My two cents

[hgg]

Hi ericcli

Yes, i'm pretty sure HP switchs (1920 most of them, some 1910) are able to accept vlans id.

I don't think HP switchs, at least not 1920s, use the "trunk" concept as in the Cisco world, in HP the vlans are tagged or untagged for a particular interface. So i should configure the required VLANs in all my switchs, configure the respective VLAN in each port as tagged and in the "trunk" interface i should add as tagged all VLANs that are going to pass through the interface to the next device or router, am i right?

If i add a vlan interface to the physical interface but i don't have configured vlans in the switchs it won't cause any problems to currently running network, do you agree?, or is it i should first and foremost setup vlans in the switchs?, i know i will have to do it eventually, but can i add the vlan interface to the physical interface without causing any interruptions?

[Adam789]

You can add VLANS sub-interfaces to the physical interfaces without any problem, in fact they will not work because you have to add a policies to be able to move traffic.

1- Create Vlans in your switch.

2- Allow vlans to move across  the trunk port.

3-Create sub-interfaces in FTG port (set vlanid, set allowaccess, set ip, set interface .....) do not use vlanid 1 unless you have changed the native vlan in your switch to something different than 1.

4- add policies to allow vlans to route the traffics (you can use zone to combine them to reduce the number of policies id). 

[sw2090]

Generally its not a good idea to use vid 1 because on many managaeable switches this is the default vid and might screw your networking in consequence.

So better use something else on your FGT to create virtual vlan interfaces. Then they will not interfere with your productive networking so far. You will of course need policies on your FGT for your vlans and you will have to do Port-Vlan-Setup on your switches to distribute your vlans further.

Vlan interfaces on a FGT are btw always untagged in that vlans - i.e. packets that go out via the vlan interface will be tagged with its vid by the FGT even if they are already tagged. On most Switches you can choose if you want the port tagged/untagged or more options.