Good afternoon! I am the owner of FortiGate600D. FortiOS 5.6.2.
First question.
I'm interested in how can I configure InterVLAN routing? Is it possible to organize it the same way as at Cisco?
For an example on Cisco
Switch # configure terminal Enter configuration commands, one per line. End with CNTL / Z. Switch (config) #interface Vlan2 Switch (config-if) #ip address 10.1.2.1 255.255.255.0 Switch (config-if) #no sh
Next, a route appears in the routing table. How to do it in FortiGate 600D?
Second question.
How to create multiple subinterface on the interface?
For an example in cisco
interface FastEthernet0 / 0.146 encapsulation dot1Q 146 ip address 155.1.146.6 255.255.255.0 end
Whether it is possible to make such in FortiGate? I'm sure it is, but I can not find it in any manual?
Thank you in advance.
Sorry for my English.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
hi boxan
if you have MLS cisco switch or cisco router it is better to do intervlan routing in MLS cisco switch, because you can do intervlan routing just by "intervlan routing".
but in Fortigate you should weite a lot of policy to doing intervlan routing , for example if you have 3 vlan , you should write 6 policy to access all vlan to each other
1 -->2
2-->1
1-->3
3-->1
2-->3
3-->2
about subinterface, fortigate do not have sub interface but it has vlan, loopback and ... type of interface
zeynab wrote:hi boxan
if you have MLS cisco switch or cisco router it is better to do intervlan routing in MLS cisco switch, because you can do intervlan routing just by "intervlan routing".
but in Fortigate you should weite a lot of policy to doing intervlan routing , for example if you have 3 vlan , you should write 6 policy to access all vlan to each other
Hey,
sorry - but this is bullshit. If you want a Firewall to do Inter VLAN routing - than there is a reason for it. In most cases Internal Segmentation.
Inter VLAN routing will happen automatically if you use Zones and put all interfaces into the according firewall zones. For the rest you will have to make policies for the traffic between those zones.
For a typical 600D deployment, you will most probably create a LACP interface from the 2 10G interfaces and put all your internal VLANs on that LACP. Then put your zones together and create firewall rules between the zones for your internal segmentation.
You should have a look into the cookbook: http://cookbook.fortinet.com/using-zones-to-simplify-firewall-policies-56/
Br,
Roman
fortigates threat vlans as virtual interfaces that are always tied to a physical port,switch or trunk on the FGT.
As far as routing is concerned they behave like any other interface. If the interface is there and up als the route to that vlan is there on the FGT automatically.
You might just need policies to allow inter-vlan-traffic to flow :)
--
"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
boxan wrote:First question.
I'm interested in how can I configure InterVLAN routing? Is it possible to organize it the same way as at Cisco?
For an example on Cisco
Switch # configure terminal Enter configuration commands, one per line. End with CNTL / Z. Switch (config) #interface Vlan2 Switch (config-if) #ip address 10.1.2.1 255.255.255.0 Switch (config-if) #no sh
config system interface
edit vlan2
set vdom xxxx
set ip 10.1.2.1/24
set interface XXX
set vlanid 2
next
end
Also you could create more than one sub-interface under physical port "XXX".
boxan wrote:Second question.
How to create multiple subinterface on the interface?
For an example in cisco
interface FastEthernet0 / 0.146 encapsulation dot1Q 146 ip address 155.1.146.6 255.255.255.0 end
Let's say you create a sub-interface on the physical port "port10":
config sys int
edit vlan146
set vdom root
set ip 155.1.146.6/24
set vlanid 146
set interface port10
end
FIAGRAM: CISCO L3 SWITCH > FORTIGATE > WAN INTERNET fortigate port1 WAN directly connect to Internet fortigate port3 connect to Cisco switch WAN SUBNET=10.0.10.0/24 port1 vlan10 DMZ SUBNET=10.0.20.0/24 port2 vlan20 CompanyA config sys int edit vlan100 set vdom CompanyA set ip 10.0.100.1/24 set vlanid 100 set interface port3 end CompanyB config sys int edit vlan200 set vdom CompanyB set ip 10.0.200.1/24 set vlanid 200 set interface port3 end REQUIREMENTS: -each vdom has its own sub-interface QUESTIONS: 1. is my fortigate vdom sub-interface correct 2. do I need to create cisco port connected to fortigate port3 as trunk port to accommodate VLAN100 and VLAN200 in port3 sub-interface
UPDATE1: -I think explained here
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1707 | |
1093 | |
752 | |
446 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.