How to block inter-vlan

[lorenzz]

Hi everyone,

I would like to ask how i will block the inter-vlan, if my vlan is in my core switch?

I have vlan created in core switch. and i create the same in fgt. By default all of the vlan are able to see each other without creating any policy.

How do i stop the vlan to see each other?

Thank you.

[Toshi_Esumi]

By default FGT does not bridge between two VLAN interfaces without any policy. If you're sure the FGT is not bridging, something else in your network is acting as a router bridging them. Is your switch an L2/L3 switch, and does it have L3 interface/IP configured? Then the switch is bridging them. You would see both subnets in its routing table if that's the case. Then you have to remove those L3 IPs from the switch and make it as L2 switch. Then only the FGT, if that's the only other L3 device, can bridge them when you create a pair of policies (I'm assuming you're not using a zone).

[emnoc]

Firewall controls traffic so if you have no policy for the src/dst the traffic is not going to sneak by. Remember this is a security device and by design it block all traffic before any specific rules

[lorenzz]

Here is my config on my coreswitch, it is layer 3 switch. There is no policy in order to reach each other vlans.  It looks like the switch are doing the routing. How do i exactly stop this?

See the attached picture.

Thank you in advance.

[sw2090]

This looks more core switch related then fortigate related. The fortigate can only affect traffic between different vlans.

You would have to look for some feature for port isoation or so on your core switch maybe.