Create a Zone for fortiswitch VLANs

[shawn-ev]

We have an FG-100F and a 48-port POE switch. We use Fortilink to our 48-port switch, and we create/manage the VLANs through switch under the WiFi & Switch Controller ==> FortiSwitch VLANs on the GUI. Is it possible to group VLANs created on the FortiSwitch into a single Zone in the same way you can group VLANs created on the firewall?

[ebilcari · Accepted solution]

Yes you can.

The VLAN interface should not be part of any policy in able to be added in the zone.

[shawn-ev]

Thank you for your help. I have a follow-on question.

Based on your answer, I would have to remove all the existing policies assigned to the various individual VLANs. After the VLANs are part of a zone, will I be able to create polices around the individual VLANs, or would I be limited to creating policies on the entire zone?

edit: grammar and clarity

[ebilcari]

Basically yes, the zone should include all the interfaces that need to have the same set of security/policy rules, https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/116821/zone

[shawn-ev]

Thank you!

[ede_pfau]

Just to clarify:

the whole concept of a zone is to group interfaces in order to eliminate (lots of) policies, thus making the policy table easier to grasp and handle.

In a policy, you would use the new zone as a source or destination interface - you just cannot select any interface which is member of a zone. BUT...you can always limit the traffic matching a policy by an address object.

For example, you group vlan1, vlan2 and vlan3 into zone "VLANS". In order to write a policy which should only deal with vlan1, you create an address object "vlan1_LAN" like 10.121.14.0/24, and use it in the policy. Even though the source interface is zone "VLANS", having the source address set as "vlan1_LAN" will only permit vlan1 traffic to be policed here.