Configure InterVLAN routing and subinterfaces

[boxan]

Good afternoon! I am the owner of FortiGate600D. FortiOS 5.6.2.

First question.

I'm interested in how can I configure InterVLAN routing? Is it possible to organize it the same way as at Cisco?

For an example on Cisco

Switch # configure terminal Enter configuration commands, one per line. End with CNTL / Z. Switch (config) #interface Vlan2 Switch (config-if) #ip address 10.1.2.1 255.255.255.0 Switch (config-if) #no sh

Next, a route appears in the routing table. How to do it in FortiGate 600D?

Second question.

How to create multiple subinterface on the interface?

For an example in cisco

interface FastEthernet0 / 0.146 encapsulation dot1Q 146 ip address 155.1.146.6 255.255.255.0 end

Whether it is possible to make such in FortiGate? I'm sure it is, but I can not find it in any manual?

Thank you in advance.

Sorry for my English.

[Saba1989]

hi boxan

if you have MLS cisco switch or cisco router it is better to do intervlan routing in MLS cisco switch, because you can do intervlan routing just by "intervlan routing".

but in Fortigate you should weite a lot of policy to doing intervlan routing , for example if you have 3 vlan , you should write 6 policy to access all vlan to each other

1 -->2

2-->1

1-->3

3-->1

2-->3

3-->2

about subinterface, fortigate do not have sub interface but it has vlan, loopback and ... type of interface

[romanr]

zeynab wrote:

hi boxan

if you have MLS cisco switch or cisco router it is better to do intervlan routing in MLS cisco switch, because you can do intervlan routing just by "intervlan routing".

but in Fortigate you should weite a lot of policy to doing intervlan routing , for example if you have 3 vlan , you should write 6 policy to access all vlan to each other

Hey,

sorry - but this is bullshit. If you want a Firewall to do Inter VLAN routing - than there is a reason for it. In most cases Internal Segmentation.

Inter VLAN routing will happen automatically if you use Zones and put all interfaces into the according firewall zones. For the rest you will have to make policies for the traffic between those zones.

For a typical 600D deployment, you will most probably create a LACP interface from the 2 10G interfaces and put all your internal VLANs on that LACP. Then put your zones together and create firewall rules between the zones for your internal segmentation.

You should have a look into the cookbook: http://cookbook.fortinet.com/using-zones-to-simplify-firewall-policies-56/

Br,

Roman

[sw2090]

fortigates threat vlans as virtual interfaces that are always tied to a physical port,switch or trunk on the FGT.

As far as routing is concerned they behave like any other interface. If the interface is there and up als the route to that vlan is there on the FGT automatically.

You might just need policies to allow inter-vlan-traffic to flow :)

[ericli_FTNT]

boxan wrote:

First question.

I'm interested in how can I configure InterVLAN routing? Is it possible to organize it the same way as at Cisco?

For an example on Cisco

Switch # configure terminal Enter configuration commands, one per line. End with CNTL / Z. Switch (config) #interface Vlan2 Switch (config-if) #ip address 10.1.2.1 255.255.255.0 Switch (config-if) #no sh

config system interface

edit vlan2

set vdom xxxx

set ip 10.1.2.1/24

set interface XXX

set vlanid 2

next

end

Also you could create more than one sub-interface under physical port "XXX".

[ericli_FTNT]

boxan wrote:

Second question.

How to create multiple subinterface on the interface?

For an example in cisco

interface FastEthernet0 / 0.146 encapsulation dot1Q 146 ip address 155.1.146.6 255.255.255.0 end

Let's say you create a sub-interface on the physical port "port10":

config sys int

edit vlan146

set vdom root

set ip 155.1.146.6/24

set vlanid 146

set interface port10

end

[nbctcp]

FIAGRAM: CISCO L3 SWITCH > FORTIGATE > WAN INTERNET fortigate port1 WAN directly connect to Internet fortigate port3 connect to Cisco switch   WAN SUBNET=10.0.10.0/24 port1 vlan10 DMZ SUBNET=10.0.20.0/24 port2 vlan20   CompanyA config sys int edit vlan100 set vdom CompanyA set ip 10.0.100.1/24 set vlanid 100 set interface port3 end   CompanyB config sys int edit vlan200 set vdom CompanyB set ip 10.0.200.1/24 set vlanid 200 set interface port3 end   REQUIREMENTS: -each vdom has its own sub-interface   QUESTIONS: 1. is my fortigate vdom sub-interface correct 2. do I need to create cisco port connected to fortigate port3 as trunk port to accommodate VLAN100 and VLAN200 in port3 sub-interface

UPDATE1: -I think explained here

https://docs.fortinet.com.../cookbook/402940/vlans

https://kb.fortinet.com/k....do?externalID=FD31639