Combine "VLAN per Port" with "VLAN per ID"

[peon3t]

Hello

Normally when I configure a FortiGate (which isn't too often anyway) I create VLANs with VLAN IDs and then work from there (assign specific ports in the switch to the desired VLAN ID respectively assign specific SSIDs in the access points to the desired VLAN ID).

Now I "inherited" a network with a FortiGate that has been set up by a previous IT guy. They used a method that I didn't even knew that it existed. They assigned one port on the FortiGate to one VLAN and the other ports to another VLAN.

Now this lead to the problem that the "Guest WiFi" actually wasn't separated from the "Office WiFi" because the access points of course were connected to one port (or rather: a switch that is connected to a port on the FortiGate) - and since everything that comes through this port is determined to be in the same VLAN, everything that comes from the access point is in the same VLAN as well.

So my question is:

Can we somehow "combine" the two methods of VLAN management, so that we don't have to redo the complete VLAN setup?

There are still a few ports on the FortiGate unused, so maybe we could hook the access points to those and then configure it in a way that those ports don't predetermine a VLAN and instead use VLAN IDs (transmitted by the access points based on which SSID the client is on) are used?

Thank you!

[sw2090]

basically on a FGT you do not assign a vid to a port. You create a vlan interface that is attached to that port. So the port is what we call a vlan trunk port. So if traffic comes in tagged with a vid that is attached to that port the traffic will hit the vlan interface and not the physical port it is attached to.

So you can have numerous vlans on one physical port and though the vid seperates them. And so do the vlan interfaces on the FGT.

[ebilcari]

Are these SSIDs configured to bridge or tunnel the WiFi user traffic? If the traffic is tunneled than the switchport when the AP connects will just see the management traffic, users traffic will be tunneled to the FGT. If the 'inherited' configuration is configured to bridge all SSID traffic to the same VLAN that used to manage the AP, than that is not secure and need to be reconfigured.

[pminarik]

You can have a look here at the VLAN options available for FortiGate interfaces:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Hardware-switch-Software-switch-VLAN-switc...

based on your description, any chance the VLAN switch mode is being used? Check if this is in the CLI:

config system global
set virtual-switch-vlan enable
end