Create VLAN for Guest wireless network

[ebeaudette]

Hi All: I have a FG100a running 3.0 MR6 patch 3 running in NAT mode. I have all 5 interfaces configured (60 workstations on internal with DHCP configured) and in use and would like to create a new VLAN that I could configure to attach a wireless access point for guests that come into our office and route there traffic only to the internet. 1. Is this possible without hosing my existing users? 2. With unmanaged switches, is this possible? 3. I know the FG100a has 4 more switch ports that are not in use. Can I utilyze these ports to do this? If so, they do not show under " System-Network" as available for configuration. Does anyone else out there have a sample config they would like to chare? Thanks in advance! Eric B

[abelio]

Hi,

1. Is this possible without hosing my existing users?

I am not sure to understand about what are you meaning but ' hosing your users' but every new usergroup should be controlled by appropiate policies to avoid bottlenecks, etc. For instance, your proposed path (Vlans) is better that another approach.

2. With unmanaged switches, is this possible?

No. You need a switch that understand 802.1q protocol.

3. I know the FG100a has 4 more switch ports that are not in use. Can I utilyze these ports to do this? If so, they do not show under " System-Network" as available for configuration.

If your 100A unit has its serial number starting with FG100A2905 you' ve a ' revision 2' unit and you could transform the 4-port internal switch into 4 independent ports. Look in system->network and you could see a ' switch to interface mode' button Take in account that in order to activate that mode, you need to clean all references to your ' internal' interface (that' s = you lost your present config ).

Does anyone else out there have a sample config they would like to chare?

If you go for VLAN path, nothing special, just treat is another interface and take care about the vlan tag in your switch config regards,

[ebeaudette]

Thanks for the quick reply Abel. My serial number starts with FG100A39075. Does your reference to rev 2 mean all serial numbers starting at FG100A2905 and above? Currently under Status-Network I have only two buttons: " Create New" and " Switch Mode." If, in fact, I can change to interface mode I assume I would no longer need to use a VLAN as I would be able to just configure a different port and use routing and policies to secure my traffic. I understand that I have to remove all the existing policies for my current " Internal" port (ouch) so in there a way to capture any and all routes/policies for that port so I can reconfigure it once (and if) I can switch modes? And would this also affect any other routes/policies that are bound to my other ports (DMZ1, DMZ2 etc) that are relative to my current " Internal" ? Sorry for so many questions, I just want to be entirely clear on what the consequences may be. Thanks again Abel.

[abelio]

you' re welcome;

My serial number starts with FG100A39075. Does your reference to rev 2 mean all serial numbers starting at FG100A2905 and above?

Exactly, you could switch into ' interface mode'

Currently under Status-Network I have only two buttons: " Create New" and " Switch Mode." If, in fact, I can change to interface mode I assume I would no longer need to use a VLAN as I would be able to just configure a different port and use routing and policies to secure my traffic.

indeed, if you click ' switch mode' button, you' ll see the options available, that you' re in (4-ports switched) and ' interface mode' with four interfaces internal1,.., internal4, that you' ll can address separately.

I understand that I have to remove all the existing policies for my current " Internal" port (ouch) so in there a way to capture any and all routes/policies for that port so I can reconfigure it once (and if) I can switch modes?

Any reference to a ' internal' interface (policies, dns forwarding, routes, vpn, DHCP, etc) will avoid you can switch to interfase mode. Unless you remove all these references (the box itself will warn you) you' ll cannot switch. Indeed, you' ll lose actual configuration and you' ll have to reconfigure it for instance for ' internal1' new interface.

And would this also affect any other routes/policies that are bound to my other ports (DMZ1, DMZ2 etc) that are relative to my current " Internal" ?

ANY reference to ' internal' interface will need to be removed and reconfigured for a new interfaces internal1 or internalX you choose. If routes/policies are between DMZXs or WANxs, no problem

Sorry for so many questions, I just want to be entirely clear on what the consequences may be.

remember 2 things: - after switch to interface mode, the 4 new internal interfaces are not addressed, so you' ll need to log into your box through WANx or DMZx interfaces if you use webGUI. Arrange the things appropiately to ensure you can do that before switching. If Not, you' ll need log using the Console to configure the new internal interfaces. - a good timesaving tip could be work a little with the backup file with a plain-text editor and replace ' internal' references with, for example, ' internal1' . You could paste those commands with CLI directly after the big change. After you recover the functionality with the four interfaces splitted, your original post will be a very easy task, working with the new interfaces. Good luck and patience.

[ebeaudette]

Thanks for the help Abel. I like your idea about using a text editor on an existing backup of the current config. I assume this means I remove all other config entries from the edited file (not associated with the current Internal) so as to only add back those necessary for re-associating with newly created Internal1. I can then attach my Colubris MSC (conrtoller for 2 WAPs) directly to Internal 2 (which supports 802.1q). This will allow me to: 1) remove an unmanaged switch between the FG and the MSC (1 less hop) 2) configure a separate IP range for Internal 2 with rules/routes (basically mimicking Internal1) 3) Configure a VLAN and bind it to Internal2, then configure same VLAN on the MSC to add my additional functionality for guest network. No small piece of work. :-) I will also keep an additional copy so I can always revert back if something hoses. Thanks again Abel.

[#6]

Does anyone know if this is possible with a FortiGate 50? I thought it was but would feel more comfortable wiping the configuration if someone knew for sure that it could or could not work. Thanks! -

[abelio]

O Does anyone know if this is possible with a FortiGate 50?

Hello and welcome, No, it is not possible for a 50 model (the splitting interfaces stuff) Assuming you´ve a 50A or 50B, you could use VLANs regards