Add second separate network through vlan or ?

[info2]

Hi everyone. I am not all that sure of how to accomplish this, so please have patience with me as I fumble my way through an explanation.

We have a Fotigate 60e. We are a smallish business and just have one network here and so the Fortigate is our single appliance to the internet. No vlans or anything fancy, just a pretty simple setup with a dozen policies etc... We have licenses for Antivirus, Web Filtering and IPS.

I have now to set up an additional isolated network (like a separate business in the same building) and we want to put that through the Fortigate unit as well. The only requirement is that I need to be able to setup separate policies for the second network, and it needs to be completely separate, as in, no way for the 2 networks to be able to talk or even see to each other.

I have read about vlans and think this is the facility that allows this, but i feel a bit swamped with jargon. I think this would allow me to leave the current setup exactly how it is, then tack on this other network through a vlan?

If anyone would be gracious enough to give me their thoughts on this, I would be very grateful.

Jono

[Toshi_Esumi]

VLANs might be necessary in case you have only one vlan-capable switch and two separate orgs are connected to the same switch. Like vlan 10 and 20 are coming out of the FGT on a single cable and into the switch. Then the switch separate them and distribute to different sets of ports.

But if your network is small enough not needing to have even a switch but using only those 7 ports on the FG60E to connect to all devices there, or have two switches and each is dedicated to each org then connected to separate ports at the 60E, you don't have to have vlans but split those 60E ports and set separate subnets on them. Then policies would keep them separated enough, which would satisfy most of security audits in case you need to comply with any.

[info2]

Toshi, thank you so much, that is perfect. I have a clear picture in my head now.

The last scenario looks like the one for us (a dedicated switch for each org going into separate ports. Could you please just clarify how I would 'split those 60E ports and set separate subnets on them'?

Thanks for your generous info :)

Jono

[Toshi_Esumi]

By default, an FG60E has 7 ports combined together into an "internal" hard-switch interface (CLI:config sys virtual-switch, I'm not sure how looks like in GUI), which act as one port. To assign different IPs/subnets to individual ports, you need to remove those ports from "internal" hard-switch, then those would show up as "internal1", "internal2", .... under Network->Interfaces [Physical section] in GUI (CLI:config sys int). Then you can configure an IP/subnet (or mulitple with secondaries) on each port.

[info2]

Your instructions sent me straight to it! I think I just did it! Whoohoo!

Thanks so much! Again!

Jono