FortiGate + FortiSwitch VLANs on both devices?

[khalavak]

Hello,

first time poster here so have mercy :)

I am new to Fortinet but a long time security / networking administrator. I recently acquired a FortiGate 40F, FortiSwitch 108F and a FortiAP 221 to test it out and learn about Fortinet. 

I am running into a stupid problem that I can't understand: 

I would like to create VLANs on both FortiSwitch and FortiGate so that FortiGate is the gateway and DHCP-server on these VLAN networks. Furthermore, I would like to use the VLANs on the FortiSwitch so that I can use multiple ports on the switch on these VLANs, say port 1-4 has native VLAN accounting_VLAN and port 5-8 has VLAN printer_vlan, etc.

I would also like to use 1 or more ports on the FortiGate on these VLANs if needed. But this does not seem to be possible, to create a VLAN and then tag the VLAN on both FortiGate and FortiSwtich ports? 

From what I can see now, if using VLANs on the FortiSwitch, I can't use these VLANs on the FortiGate ports and use the FG ports for connecting devices to the VLANs that I use?

High Level overview of what I am trying to do:

1. Create VLAN accounting_VLAN(VLAN ID=10) and office_VLAN(VLAN ID=20) on FortiGate with IP-address and DHCP enabled etc. so that the Fortigate is the gateway for the VLAN network. 

2. Use the accounting_VLAN on FortiGate ports so that devices can be plugged into the FortiGate and assigned to one of these VLANs.(if FG-40F, then less ports to use, if 200F then more ports to use)

3. Connect FortiSwtich to FortiGate using Fortlink.

4. Trunk the accounting_VLAN on the trunk to the FortiSwitch

5. Use the accounting_VLAN ports on the FortiSwitch, for example ports 1-8 on accounting_VLAN and ports 9-13 on office_VLAN.

However, this doesn't seem to be possible from my testing different configurations? I can create VLANs on the FortiSwtich and tag them as native VLANs on different ports, but I can't use those VLANs on the FortiGate for creating a firewall/gateway interface to those VLANs. 

What am I missing? 

Best regards,

Kim,

[christian_s]

Hi!

I had the exact same topic. I managed to solve it like that:

1) add a VLAN to the FortiLink interface. Important: disable the option "create address object matching subject". This is crutial, as soon as you have a reference on the vlan you can't add it to software switch anymore

2) add the VLAN to the software switch (like you do with a physical interface), it should be available now

3) now you can assign the vlan to a port on the fortiswitch and it should assign correctly and you should receive an IP address from DHCP configured on the software switch

I hope that helps.

Kind regards,

Christian

[MateWorks]

Hi @christian_s 

This version worked for me, thanks a lot!

I assigned in the software switch VLAN, Wifi SSID, and native ports and working well.

Regards,

Krisztian

[FPatrik]

Hi all,

It's been a few years since this post :) 

Is there a better way of doing the above now? 

Thanks! 

[boneyard]

I don't think so. To be honest I don't see this ever happening, it doesn't match with how FortiSwitch managed by FortiGate is setup.

If anyone with the right contacts can ever ask this of FortiSwitch product development that would be helpful.

[Dongxian_Yao_FTNT]

I have a 40F at home with a FS-224E I just purchased from eBay, both running latest 7.4 firmware. I think I get it working without using software switch.

Before I bought this FS-224E, I configured 40F with default "internal" (virtual-switch) interface and includes lan1/2/3+"a" all 4 ports, and I have multiple VLANs on this internal interface, (I also have multiple VDOMs and these VLAN sub-interfaces on "internal" port are in different VDOMs), and I connect "a" port to old HP Procurve switch, and I tag/untag VLANs properly so I can connect my devices on HP switch.

With the new FS-224E, I would like to use it with both FortiLink and also as dummy switch like my old HP so I can extend my VLANs to. And here is my solution for now,

1) keep this "internal" interface (virtual-switch) with lan1/2/3+"a" as it, and all those vlan sub-interface on "internal";

2) do "set fortilink enable" on "internal" interface, be aware, when you enable fortilink on an interface, the allowaccess will be reset to ping and fabric, so if you manage your FGT using this "internal" interface, the simple workaround is to configure a secondary IP and proper allowaccess on this "internal" interface;

3) connect and authorized your FSW

4) On GUI, you can't assign those existing FortiGate VLANs to FSW ports, but you can do it with CLI, see below, I have this VLAN 199 on my FGT and how I put it to FSW port,

# FGT

config system interface
edit "labv199"
set vdom "lab"
set ip 10.80.199.1 255.255.255.0
set interface "internal"
set vlanid 199

...
next
end

FGT (root) # conf switch-controller managed-switch

FGT (managed-switch) # edit S224ENTFXXXXXX

FGT (ports) # edit port20

FGT (port20) # show

# before I put VLAN 199 on FSW port

config ports
edit "port20"
set ptp-status disable
set vlan "_default"
set export-to "root"
set mac-addr d4:76:a0:6a:d3:67
next

end

# now I assign VLAN 199 to FSW port
set vlan "labv199"
set allowed-vlans "labv199"
set untagged-vlans "labv199"

end

5) Then I connect my device to this port and it works

Hope this helps.