Fortigate 5.4 - Changed from Software Switch to Hardware Switch Mode

[NotAFortigateGuru]

Hey everyone!

Please bare with me, im not an expert with firewalls/fortigates.  Short and sweet:

1) Was forced to turn off software switch mode because my internet downloads were maxxed out at 150mbps on a 1000mbps line.  Fortigate CPU would leap to 99% on large downloads.

2) Successfully changed fortigate firewall 5.4 to hardware switch mode.  All my internal interfaces are now Internal1 -> Internal14

3) Successfully applied ip address to Internal1 (port1) and have full access to internet on that port (and almost full 1000mbps speeds) 

Here is where I am stuck

1) All my computers cannot communicate with one another even with IPv4 Policy saying all switch interfaces (1-14) can speak to one another

2) Cannot apply internal gateway address given to Internal1 (192.168.1.1) to other interfaces so only PC on Internal1 can get internet service

Any suggestions?  I feel like im so close in nailing this down, just stuck on this part.

[TecnetRuss]

If each interface is listed individually as a separate row, as Interface1, Interface2, … etc. then each interface is its own hardware "switch" and they are not bridged.  That's what it sounds like when you describe assigning an IP address to an individual port.  What you should see is a single row called "Internal" with all LAN ports showing up together in the Members column.  If you didn't create a hardware switch after breaking the software switch, you need to click on "Create new" / "Interface", set type to "Hardware Switch" and add in all your LAN ports as members.  Then all your member ports will be bridged and are treated as a single "Internal" switch object, policy-wise.

Note that not all FortiGate models support Hardware Switches.  You didn't mention which model of FortiGate you have.  If you do not see "Hardware Switch" in the New Interface page's Type menu then your model only supports Software Switch mode.  For example, I believe the FortiGate 200E is an example of a unit that doesn't support Hardware Switch mode.

Russ

[NotAFortigateGuru]

I believe you are correct and this is the missing piece that I needed.  I am testing this on a fortigate 90D.  I will reload my test config tomorrow and try to create a hardware switch and tie all those ports together.

Thank you very much for the help.  I knew I just needed one or two more steps to get our full 1000mbps up and running correctly.