All,
I'd like to share my quick guide on creating trunk and access ports in transparent mode using a single virtual domain (VDOM). I'm a FortiOS newbie but I think this is a working solution for those that are interested.
Some key pointers:
[ul]Here is an example of this on an FG-140D, with ports 1-20 on VLAN 10, ports 21-34 on VLAN 20, and ports 35-36 as a port-channel trunk:
## Configure Transparent Mode config system settings set opmode transparent end ## Configure access ports for VLAN 10 config system interface edit "port1" set vdom "root" set type physical set forward-domain 10 next ... (mirror the above config for the other ports, up to port20) ## Configure access ports for VLAN 20 edit "port21" set vdom "root" set type physical set forward-domain 20 ... (mirror the above config for the other ports, up to port34) ## Configure a LAG interface edit "port35" set vdom "root" set type physical next edit "port36" set vdom "root" set type physical next edit "po1" set vdom "root" set type aggregate set member "port35" "port36" set lacp-mode active next ## Configure trunked VLANs on LAG interface edit "vlan10_po1" set vdom "root" set forward-domain 10 set interface "po1" set vlanid 10 next edit "vlan20_po1" set vdom "root" set forward-domain 20 set interface "po1" set vlanid 20 end
[style="color: #222222;"] [/style]
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
When I first set up one of my units in transparent mode, I was planning on doing a similar setup as yours. However, the engineer from the vendor we were using suggested a slightly different approach. In your setup, the firewall is acting as a switch. His argument was let the switch be the switch and the firewall be the firewall. So instead of creating access ports on the firewall, you set up an aggregate on the firewall that trunks all relevant VLANs and traffic goes in and out through the aggregate trunk. Servers sit on switch ports that are locked to specific VLANs and the only ports that allow all VLANs are the ones going to the firewall. The switch handles L2 separation and the firewall performs VLAN translation as traffic needs to traverse different VLANs. This allows you to not be limited by the firewall's onboard ports to connect devices and frees those ports up for other purposes such as different VDOMs or one arm sniffers, etc...
The only quirk I found when setting it up is that the transparent mode seemed to send MAC advertisements on both the VLAN tagged and untagged interfaces. So the switch would detect "port flapping" and shut it down. I had to create a blackhole VLAN on the switch and route all untagged traffic to it to prevent this from being a problem.
Either way, transparent internal segmentation does work really well for many use cases. Thanks for the write up.
CISSP, NSE4
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1517 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.