How to create and Communicate subnet like 10.20.30.0/24, 10.20.28.0/24,10.20.29.0/24 on Fortigate FW

[atifali681]

How to create and Communicate subnet like 10.20.30.0/24, 10.20.28.0/24,10.20.29.0/24 on Fortigate HA firewalls. Whereas access switches are cisco with only by default configurations. Having vlan 1 passed. In current scenario, subnet 10.20.30.0/24 working fine with multiple policies of firewalls. 

If we create multiple networks on firewall, How we can control users if static ip assigned to wired pc/nodes while creating security policies, firewall policies. 

[knaveenkumar]

Hi,

Create a Vlan and assign these subnets on particular vlan 

create policy and allow them
-Naveen 

[ede_pfau]

I am truly confused...where to start?

You create VLANs in Network - Interfaces, Create, VLAN. You _have_ to enter an IP address, like 10.20.30.1/24. The .1 becomes the VLAN's gateway, the /24 determines it's size.

Always enable Ping on any interface you create. Check connectivity by pinging your gateway from the host.

If you like, you can create a DHCP server on that same page, so that your hosts get addresses assigned (instead of static addresses).

[atifali681]

Thanks for sharing knowledge ede_pfau,

Yes i have already done configurations for this network, What about if i need to add further 3 networks on firewall 10.20.31.0/24, 10.20.29.0/24 and 10.20.28.0/24 and these all networks are attached will be attached via cisco switches having vlan 1 and switch is directly connected with firewall. We need to manage all traffic from firewall. I mean there is no vlans in layer 2 level. Gateways are directly on firewall. Client dont want to perform long activity for vlans segregattion currently?

[atifali681]

I mean , if i want to run 3 other /24 subnets on firewall using same 1 lan interface on firewall either its possible , if possible then how i can manage its policies of users/node. Either defining ip addresses pools like 10.20.30.2 to 10.20.30.10 etc 

[ede_pfau]

If I understand you correctly, you want to run multiple LANs with different addresses on VLAN1, so that the switch will not be VLAN-aware?

You could do that...but you should not. If you introduce VLANs you will be able to separate traffic from each other, especially broadcast traffic.

OK, let's assume you cannot use VLANs (because of switch). Then you could create secondary addresses on the same Fortigate port:

config system interface
    edit "wan2"
        set vdom "root"
        set ip 1.2.3.4 255.255.255.0
        set allowaccess ping
        set secondary-IP enable
        config secondaryip
            edit 1
                set ip 10.20.30.1 255.255.255.0
                set allowaccess ping
            next
            edit 2
                set ip 10.20.29.1 255.255.255.0
                set allowaccess ping
            next
            edit 3
                set ip 10.20.28.1 255.255.255.0
                set allowaccess ping
            next
        end
    next
end

Note that you will have to specify a valid address, that is, not '1.2.3.0/24' but '1.2.3.1/24'.

This results in static routes being created for each additional subnet:

gate8 # get router info routing-table connected
Routing table for VRF=0
C       10.10.234.0/24 is directly connected, wan1
C       10.20.28.0/24 is directly connected, wan1
C       10.20.29.0/24 is directly connected, wan1
C       10.20.30.0/24 is directly connected, wan1
...

Without these routes, traffic would be dropped silently as being of unknown origin.

There is a limit to the number of secondary addresses which (probably) depends on the FGT model.

As already mentioned, the clean way to do this is to create VLANs (VLAN interfaces) off of the physical port you use, and create these VLANs on the switch. A FortiSwitch would inherit these VLANs btw.