Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
avilt
New Contributor

Fortinet Interface Selection WAN, DMZ

Is it mandatory that I chose WAN interface for Outside segment, DMZ interface for DMZ segment. Is there any hard coded settings such as security levels for these interfaces?

1 Solution
Paul_Dean
Contributor

They are labels for convenience. You can apply policies and virtual IPs to any interface.

 

We had an early FortiGate 80C model which has two gigabit WAN ports and a fast ethernet internal switch. I turned the switch into interfaces and used the WAN ports as LAN ports. The internet connection is less than 100Mbps so it seemed like a waste to use a gigabit port. It's slightly confusing as it's still labelled WAN but you can use an alias.

 

Check if the ports you want to use are connected to a network processor. This will speed up forwarding of packets by offloading sessions from the CPU after initial setup. Larger FortiGates use network processors. Small FortiGates have a system on a chip. Depending on your model and requirements this may affect the interfaces you want to use.

NSE4

View solution in original post

NSE4
4 REPLIES 4
Paul_Dean
Contributor

They are labels for convenience. You can apply policies and virtual IPs to any interface.

 

We had an early FortiGate 80C model which has two gigabit WAN ports and a fast ethernet internal switch. I turned the switch into interfaces and used the WAN ports as LAN ports. The internet connection is less than 100Mbps so it seemed like a waste to use a gigabit port. It's slightly confusing as it's still labelled WAN but you can use an alias.

 

Check if the ports you want to use are connected to a network processor. This will speed up forwarding of packets by offloading sessions from the CPU after initial setup. Larger FortiGates use network processors. Small FortiGates have a system on a chip. Depending on your model and requirements this may affect the interfaces you want to use.

NSE4
NSE4
avilt

That is a interesting point.

I have a fortinet 200D model, how to know the ports that are connected to a network processor?

I believe from the security point, I can use any for inside/outside connections. Am I right?

emnoc
Esteemed Contributor III

All good points and unless your dealing with the bigger enterprised chassis and want to know what port are  bound to a ASIC ( i.e 3X40 ) than the port name is no revelant. FWIW I use my DMZ for a MPLS back and my DMZ is a 802.qq tagged subinterfaces off WAN2 .

 

 

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Paul_Dean
Contributor

Yes you can use any for inside or outside connections.

 

Have a look at the "get hardware npu" command. There are some options there which can display the NPU and which ports are assigned to it.

 

http://docs-legacy.fortin...2520CLI/get.33.15.html

NSE4
NSE4
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors