FortiGate to Cisco switch

[Stephen_S]

Hello, first time posting in the forum.

We need some help, need step-by-step assistance adding FortiGate 80E to Cisco 3750 stack, we have multiple different subnets, would like them all to coming together, seems there is multiple ways posted online for doing this, what's the best way to do this. We have several interfaces with IP's/SVI on Cisco stack, along with several VLANS. Not sure how to configure the FortiGate for the new networks, if routing is required, Policies we should create to allow all networks to connect.

Thank you all for your help

[gfleming]

Before you push all your VLANs/SVIs to your FortiGate be aware that the FortiGate 80E will not handle nearly as much routing capacity as your existing 3750 stack. It will push a maximum of 4Gbps of pure routing/stateful firewalling for inter-VLAN routing. That is *not* counting any NGFW features for WAN access which top out around 300mbps.

So if you have a WAN link that is even close to 100-200mbps *and* you are pushing inter-VLAN routing through the 80E you may find you are exhausting it very quickly. 

What is your expected utilization for NGFW and WAN access as well as for inter-VLAN east-west traffic flows? What NGFW features will you use on the WAN (IPS, Web Filter, etc)?

To answer your question about VLANs on the Fortigate, the best way to do this would be to create VLANs under the physical interface that connects to your Cisco Switch. And configure the same interface on your Cisco as a trunk interface with the VLANs tagged appropriately.

[Stephen_S]

Wow, thanks for showing me how little we know about the FortiGate 80E.

With that said, this is a remote site, have over 300Mbps WAN pipe.

Only looking to have all subnets /VLANS talk with each other.

We tried adding the VLANS under the primary LAN port in the FortiGate only able to talk to the one subnet defined on that port or the primary LAN on port 1, we created 3 sub interfaces as VLAN1, Vlan2, Vlan3 but the devices on the Cisco switches can't ping anything. not sure on the Policy to create for allowing all Subnets/IP's/VLANS to talk to each other each other. what are we doing wrong.

Thank you

[gfleming]

Here's some docs on VLAN config: https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/402940/vlan

So yep you'll need firewall policies to all all the traffic from each VLAN. So source int will be VLAN X and dst int will be VLAN Y (and vice versa most likely). If you don't have these policies defined, no traffic will flow. Also if you don't allow ICMP access on the VLAN interface, you won't be pinging the VLAN interface either.

I would be careful about pulling all your VLANs up to the FGT-80E especially if you WAN pipe is over 300mbps.

Do you need all your VLANs on the Firewall? You have a perfectly capable L3 switch right now which supports ACLs.

[ede_pfau]

just to add my 2 cents...

If you need to connect/allow each VLAN to each other VLAN, then you will need a couple of policies. Pro tip: create the policy for one direction, then right click it in the policy table and "clone reverse". This cuts your effort by 50%.

As for the design, consider building an aggregate link of more than 1 interface to the switch. You don't have to assign it an IP address. Create your VLANs as subinterfaces of this trunk. This way, any VLAN can use the aggregated bandwidth if needed (i.e. for backup jobs).

Link aggregation uses the standard LACP protocol which (even) Cisco supports.

And yes, I admit the 80E is no burner with a max of 4 Gbps, but I've seen a lot of VLANs not utilizing nearly as much bandwidth as physically provided. IMHO even with routing the FGT should be fine.

If not, upgrade to an 100F or 200F.

[Stephen_S]

Ok, reading the VLAN guide, this is great, sub interfaces created, assigned DHCP to give IPs, and this is working for the laptop/desktop's, created policy to allow VLAN 1 to talk with VLAN 3, and another to allow VLAN 3 to talk with VLAN 1, but we can't ping anything or SMB file shares. We even created Static routes then removed when they failed to work. What are we missing my friend, I'm shaking my head from left to right, the answer is there.

Thank you

[gfleming]

Just to be clear when you say "this is working" are you referring to DHCP address assignment only? And no traffic is flowing between the VLANs at all?

If so let's make sure devices in VLAN 1 and VLAN 3 can ping the gateway address on the FortiGate.

Also let's make sure the 3750 is not getting involved anymore. That is, devices are not using it as the default gateway still. If so then the firewall won't work if only one half of the session is flowing through it. (broken session state).

Let's finally review your policies for VLAN 1 <--> VLAN 3. Can you please show screenshot or config snippet?

[Stephen_S]

Hello, my friend, we did as you said, checked our work, and we found the mistakes, or missing items as you mentioned. Guess what, everything is working, Wow - have we thanked you yet, thank you so very much my new friend. Let me ask do you live in the US, if so allow us to show our appreciation by buying you lunch. or you chose how we can give you something in return.

Thank you 

[Stephen_S]

We found one problem: all VMWare hosts not able to talk anymore, they are on the LAN gateway of the FortiGate firewall, not able to talk to anyone, do we need another policy for local LAN traffic to talk among themselves? 

After checking this new issue, looks like nothing on the Cisco 3750 switch can talk to the FortiGate firewall, not able to ping the LAN address of the firewall same subnet on 3750 has SVI IP address, firewall not able to ping the 3750 either. 

Thank you

[gfleming]

Are VMWare hosts all on the same VLAN? Are they using the FortiGate as the default gateway? If they are all on the same VLAN they should be able to talk to each other as that traffic won't be filtered by the Fortigate (it will remain local to the switch as L2 traffic). If they are on different VLANs then yes you need policies on the FGT allowing the traffic in question.

You need to allow ICMP PING access on the FortiGate VLAN interface otherwise it will not respond to pings. Please ensure you have this enabled for any future testing.

If you are moving all your VLANs to the FortiGate firewall you do not need SVI IP addresses on the 3750 anymore. In fact this could be a source of conflict if some devices are using the SVI on 3750 as default gateway and some are using the VLAN interface on FGT as default gateway. Please check for conflicts there.