Fortinet Interface Selection WAN, DMZ

[avilt]

Is it mandatory that I chose WAN interface for Outside segment, DMZ interface for DMZ segment. Is there any hard coded settings such as security levels for these interfaces?

[Paul_Dean · Accepted solution]

They are labels for convenience. You can apply policies and virtual IPs to any interface.

We had an early FortiGate 80C model which has two gigabit WAN ports and a fast ethernet internal switch. I turned the switch into interfaces and used the WAN ports as LAN ports. The internet connection is less than 100Mbps so it seemed like a waste to use a gigabit port. It's slightly confusing as it's still labelled WAN but you can use an alias.

Check if the ports you want to use are connected to a network processor. This will speed up forwarding of packets by offloading sessions from the CPU after initial setup. Larger FortiGates use network processors. Small FortiGates have a system on a chip. Depending on your model and requirements this may affect the interfaces you want to use.

[avilt]

That is a interesting point.

I have a fortinet 200D model, how to know the ports that are connected to a network processor?

I believe from the security point, I can use any for inside/outside connections. Am I right?

[emnoc]

All good points and unless your dealing with the bigger enterprised chassis and want to know what port are  bound to a ASIC ( i.e 3X40 ) than the port name is no revelant. FWIW I use my DMZ for a MPLS back and my DMZ is a 802.qq tagged subinterfaces off WAN2 .

[Paul_Dean]

Yes you can use any for inside or outside connections.

Have a look at the "get hardware npu" command. There are some options there which can display the NPU and which ports are assigned to it.

http://docs-legacy.fortin...2520CLI/get.33.15.html