Fortigate 90G Wan2 redefined as LAN?

[okllee]

Hi, since I've recently acquired a 10G fiber home connection. I'm kicking around an idea of how to go about getting the most out of the connection.

If I recalled correctly, its possible to define any interface to perform any roles. Is that still correct?

I'm thinking of getting a 90F, and refining WAN2 as the primary LAN interface, and not use the 1GE ports at all or just redefine it as DMZ. Also, throw in dumb 10GE switch behind LAN (WAN2) that so my primary / higher priority computers and devices they would benefit from maximum available speed https://9apps.ooo/ .

Does this configuration seem reasonable and possible?

Preemptively thank you for the inputs

[Toshi_Esumi]

You should be able to. Virtually all ports on any FGT models can be used for either wan or lan ports.

Toshi

[ghanbal1]

Yes . I did exactly this for a location with a multigig internet circuit. Be aware that you don't get 4 10GB interfaces only 2 because the SFPs and Ethernet are shared media.

[asindona]

Could you share the howto? I'm trying to reconfigure the wan1/wan2 ports as LAN and use portA and B as WAN due to the fact that I want to use the SFP ports with 10G fiber links internally. I already changed successfully the role of A and B ports.

I changed the role with set role lan in both wan1 and wan2 ports but when I want to add to the fortilink aggregated interface I get an error and I can't figure why. 
In my design SFP1 and 2 will be trunk port for both fortilink connectivity and for all other VLANs

[asindona]

After some headache and many bad words :D I figured out how to do so I want to share it.

Start by NOT deleting the fortilink aggregated interface but with deassociating A and B interfaces from the fortilink.

IMPORTANT: If Wan1 and Wan2 have been previously added to the virtual interface for SD-WAN, remove the interface from the virtual link.

Then, before adding wan1 and wan2 to fortilink aggregate, you need to do some changes with CLI.

config system interface

    edit "wan1"

        set vdom "root" # It should already be this way

        set type physical  # It should already be this way

        set speed 10000auto # or 1000auto Change according to SFP/SFP+ transceiver

        set role undefined

    next

    edit "wan2"

        set vdom "root" # It should already be this way

        set type physical  # It should already be this way

        set speed 10000auto # or 1000auto Change according to SFP/SFP+ transceiver

        set role undefined

    next

    edit "a"

        set vdom "root"
        set mode dhcp # Or change according to your provider settings
        set type physical
        set alias "WanA"
        set lldp-reception enable
        set role wan

    next

    # Do the same with interface "b"

MODIFY the default policy from lan->wan removing Wan1 and Wan2 and adding WanA and WanB (the newly renamed interfaces)

Now you can add Wan1 and Wan2 to the "fortilink" interface (from GUI or CLI).

[KathyPhifer]

Yes, your plan is entirely reasonable. On FortiGate devices, any physical interface can be redefined to act as WAN, LAN, or DMZ — the role is purely logical. So, on the FortiGate 90F, you can absolutely redefine WAN2 as your primary LAN interface to take advantage of your 10G fiber connection. Then, connecting a 10G unmanaged switch behind that interface for high-speed local devices is a solid setup.

Just make sure to adjust your interface roles, zones, and policies accordingly in the FortiGate GUI, disable the default WAN settings on that port, and reassign it to the internal network zone. Also, double-check your NAT and routing rules, since redefining WAN2 changes how traffic flows. Once configured properly, you’ll get full 10G performance on your LAN while keeping the 1G ports for DMZ or backup connections. meilleur iptv