Fortinet connect to core switch

[Silver]

Dear All, Can someone guide me what is the best way to setup fortigate in this scenario plz. 1) i have a fortigate & a core switch 2) they are having several vlan configured on the core switch included vlan for voice 3) right now intervlan routing if being done on the core switch 4) if we need to install fortigate as firewall how we can simply the config to the best way 5) i have several server on a specific vlan and also some server web server will need to access from outside on the internet. 6) i have also some vpn users who will need to access the internal resources from outside the network 7) The important thing also if i want to block certain users from a specific vlan not to access other vlan if it will be possible. The way i want to setting up the fortigate i want to configure an interface on the fortigate example port 1 & port 2 as link aggregation and connect the core switch on port 1 & 2 as aggregation using LACP protocol. And configure and ip address on the fortigate link aggregation interface and configure an ip address to a vlan on the core switch. And on the core switch configure a default route going to the fortigate. Can anyone may help me plz thanks alot

[Silver]

Thank you very much for your reply, i really appreciate. if fortigate is useless in this setup. can you propose me the best way to setup it plz thanks

[emnoc]

Easy Set the SVI ( switch virtual interfaces ) on the Fortigate and free them from the core routers. So basically you will have a 8021.q trunk from the core switch to the FGT. cisco config t int gi 1/1 description uplink to FGT switchport mode trunk switch trunk allow vlan 10,20,30 end and on the FGT you would setup 3 virtual interfaces with vlan tags 10,20,30 config system interface edit vlan10 set vdom root set ip 10.10.20.1 255.255.255.0 set interface " port1" set vlanid 10 set allowacces ping next edit vlan20 set vdom root set ip 10.10.20.1 255.255.255.0 set interface " port1" set vlanid 20 set allowacces ping next edit vlan30 set vdom root set ip 10.10.30.1 255.255.255.0 set interface " port1" set vlanid 30 set allowacces ping next Better yet, you could bundle 2 or more interfaces into the FGT and have redundant links; cisco config t interface range gi 1/1-2 default switchport switchport channel-group 1 mode act channel-protocol lacp no shut interface port-channel 1 switchport mode trunk switch trunk allow vlan 10,20,30 description " uplink bundle to FGT" end And on the FGT config sys interface edit bond0 set vdom root set type aggregate set member port1 port2 next edit vlan10 set vdom root set ip 10.10.20.1 255.255.255.0 set interface bond0 set vlanid 10 set allowacces ping next edit vlan20 set vdom root set ip 10.10.20.1 255.255.255.0 set interface bond0 set vlanid 20 set allowacces ping next edit vlan30 set vdom root set ip 10.10.30.1 255.255.255.0 set interface bond0 set vlanid 30 set allowacces ping next end So basically you have FGT-----802.1qtrunk ----core ----- vlan 10,20,30

[Silver]

Okay thank you very much. so the way you have post the config mean the intervlan routing will perform on the fortinet appliance and will need to remove the intervlan routing on the core switch good. One thing don' t you think that it will handle to much traffic the fortigate around 425 users will be on the network

[emnoc]

Yes And for the 2nd part 425 users is irrelevant. What are they doing? How much encrypted traffic? What' s the uplink? How much inter-vlan traffic? How much UTM features? And then the most important thing.......What size model of FGT ( e.g FGT30B vrs FGT200B )?

[Silver]

UTM feature : web filter / IPS/ Application control. and may be email filter also. model 600C uplink is etherchannel from access switch to core and from core switch to fortigate

[emnoc]

That' s a plenty of firewall, but you still view how much aggregate traffic including uplink ( 10/100/1gig etc.....) So you have that answer that,but that should be great. Most groups would do all routing on the core but if you need inter-vlan restriction the firewall would make sense.

[Silver]

thanks you very much for your input

[Soe_San]

Hi,

Is the above explanation still correct?

[iqbal_2535]

can you pl tell

1. do you have fortigate in your existing infra or you want to add new one.

2. do you want that after seting up fortigate, inter VLAN routing will be done by fortigate only? 

[sw2090]

Maybe it helps you with your decision, i could tell you how I do that here:

We have a fortigate and several switches at every shop and also here at the IT. Between us and the shops we run ipsec tunnels.

Each shop has a bunch of vlans (vids are standardized at all of them) and its own Subnets for those plus one default subnet that has no vlan..

Inter-vlan-routing and UTM and IPSec (and with that inter-vpn-routing) is done by the FortiGates. 

I think that's the most easy way since basically on the fgt all you need is vlan interfaces, objects for the subnets and then policies to allow or not allow access between vlans or vlan and internet or (in our case) vpns to vlans usw.

On the Switches you then just need to to vlan setup and port-tagging. All you then need is an uplink to the fortigate which is tagged in all but one vlan (for it must be untagged in one *g* - I usually use the default vlan 1 for that and take that for the subnet that does not have a vlan). And then you just have to set your switchports to where they should be (no/forbid/tagged/untagged) depending on what you need there. Just remember if the port is tagged in vlan the device that connects to that port will have to do vlan tagging itself. If you just want the device to be just in this vlan set it to untagged in that vlan and the rest to no/forbid. In this case the switch will do the vlan tagging for the device and the fgt will do the routing.

this work fine here with FGT100E and 90Ds with an overall of 30-40 Clients per shop.

hth

Sebastian