FortiGate to Cisco Setup

[jmart1191]

I am in the process of rebuilding my network, I currently use cisco 9300's to carry traffic to each site via metro-e. The cisco's currenlty have Vlans and DHCP configured. I would like to implement at each site a fortigate 200f and 2 cisco 9200's to physically seperate vlans. I still for the meantime want the vlans and dhcp to be distributed by the cisco switches, we have different vlans one has internet, the other doesn't by design. I want a port from the fortigate to have the vlan from the internet to the cisco that will have internet acccess, and i want another port on the fortigate to carry the network to the other switch, again while the cisco's still assign Vlans and Dhcp. How would I go about doing this? I will eventually move all to the fortigate but we have to prove that it works for what we need. And i would need the cisco's to still pass traffic to the other cisco sites that will not have a fortigate (we will move to foritgate at each site if we can get this working).

[Toshi_Esumi]

Not exactly sure what your intending design is without a diagram. Do you want to extend internet/public subnet from the FGT to C9200, or want to terminate the internet/public IP at the FGT but have an internal(private subnet) VLAN, say VLAN 100, shared between the FGT and the C9200 while the DHCP/GW is provided by the C9200?
You mentioned another connection between them to carry all other VLAN traffic. But if those don't need/have internet access, it would be just for a prep to migrate the DHCP to the FGT for those VLANs.

Toshi

[amrit]

To achieve this you you can create VLANs on two ports of the fortigate 

example

1. create a vlan under port1 of fortigate but don't enable dhcp on this vlan -- connect the existing cisco device on this port, the device should send the tagged traffic to this interface

You need to create a firewall policy from Vlan to the internet 

2. create another vlan under port2 of the fortigate 

Add a policy for routing this traffic to the required destinations 

You must add the static routes for the destination if required.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-create-a-VLAN-tagged-interface-802-... 

[sahmed_FTNT]

Hello, as per your query:

Query: I want a port from the fortigate to have the vlan from the internet to the cisco that will have internet acccess,

-> For this you can configure one port on the with internet facing and another port towards cisco, create a policy and it should good.

Query:  I want another port on the fortigate to carry the network to the other switch, again while the cisco's still assign Vlans and Dhcp.

same setup can be used to communicate between one fgt port and switch 

You can consider creating a trunk on the fgt, create vlans on the fgt and route traffic accordingly