We have an FG-100F and a 48-port POE switch. We use Fortilink to our 48-port switch, and we create/manage the VLANs through switch under the WiFi & Switch Controller ==> FortiSwitch VLANs on the GUI. Is it possible to group VLANs created on the FortiSwitch into a single Zone in the same way you can group VLANs created on the firewall?
Thank you for your help. I have a follow-on question.
Based on your answer, I would have to remove all the existing policies assigned to the various individual VLANs. After the VLANs are part of a zone, will I be able to create polices around the individual VLANs, or would I be limited to creating policies on the entire zone?
the whole concept of a zone is to group interfaces in order to eliminate (lots of) policies, thus making the policy table easier to grasp and handle.
In a policy, you would use the new zone as a source or destination interface - you just cannot select any interface which is member of a zone. BUT...you can always limit the traffic matching a policy by an address object.
For example, you group vlan1, vlan2 and vlan3 into zone "VLANS". In order to write a policy which should only deal with vlan1, you create an address object "vlan1_LAN" like 10.121.14.0/24, and use it in the policy. Even though the source interface is zone "VLANS", having the source address set as "vlan1_LAN" will only permit vlan1 traffic to be policed here.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.