Basic question about VLAN design

[fl0at0xff]

Hello,

I just have a basic question: When you configure a Fortigate, what is the best practice regarding the configuration of VLAN ? For example, imagine I have 5 different VLAN in my network, I want to make the inter-vlan routing with the fortigate, how can I configure the interfaces ?

- It is better to create 5 vlan-interface under only one physical interface

- It is better to create 5 vlan-interface under 5 physical interfaces (one per vlan)

- It is better to use 5 physical interfaces as access interfaces ?

Thank you for you answers

[Somashekara_Hanumant]

Hello,

- It is better to create 5 vlan-interface under only one physical interface

>>> Yes you can configure 5 VLAN interfaces on only one physical interface

- It is better to create 5 vlan-interface under 5 physical interfaces (one per vlan)

>>> You can configure each VLAN on different physical interfaces, advantage of multiple VLAN's on multiple interfaces is bandwidth

- It is better to use 5 physical interfaces as access interfaces ?

>>> This option also similar to the above option, you will be dividing the bandwidth on 5 interfaces,

Please refer the below documents also.

http://help.fortinet.com/...%20in%20NAT%20mode.htm

https://www.youtube.com/watch?v=NVLDRHLWbWc

Cheers

Somu

[fl0at0xff]

Hello and thank you for your answer.

Ok for the bandwidth argument. I understand the added-value tu use separate interface.

Now, when is it preferable to create one VLAN sub-interface per physical interface and when use directly the physical interface. Does it depend only of the configuration of the switch on the other side ? 

[Nils]

I would prefer to use Link Aggregation.

Aggregate several physical interfaces and then create vlan interfaces under the logical bundle.

But this is only supported on series above 100D(?).

Otherwise I would say that if you think you'll create new networks in the future, its better to go with VLAN intefaces. Then it's easy to just add a vlan to that interface and configure an IP-address without having physical access to the firewall.

[fl0at0xff]

Hello Nilsan and thank you for this answer ! Your solution looks great and interessting in terms of available bandwitdh. But how do you handle /configure LACP ? I think, I will prefer the solution with vlan interface for reason of scalabilty. For example, if a I have a 60D with 7 ethernet ports and I need to create 7 vlan, I will use a vlan interface per physical port and with this solution, if in the future I need to add a new vlan, I can simply add a new vlan interface ... I think it could be a good reflexion 

[rwpatterson]

fl0at0xff wrote:

Hello Nilsan and thank you for this answer ! Your solution looks great and interessting in terms of available bandwitdh. But how do you handle /configure LACP ? I think, I will prefer the solution with vlan interface for reason of scalabilty. For example, if a I have a 60D with 7 ethernet ports and I need to create 7 vlan, I will use a vlan interface per physical port and with this solution, if in the future I need to add a new vlan, I can simply add a new vlan interface ... I think it could be a good reflexion 

I think you are confusing link aggregation with VLANs. The series below 100d(?) cannot share data between ports (LACP), but yes you can put multiple VLANs on a singe interface (802.1q tagging).

Hope that helps

[fl0at0xff]

Hello and thank you for your answers ! I have a better idea how to configure/handle VLANs on Fortigate regarding the needs and possibilities of my clients.

Thank

[MikePruett]

Yeah, if you are going to have a bunch of traffic flowing (more than the port you are building the VLAN's onto will support) then bundle those things up and enjoy the aggregated bandwidth benefit.