Hello,
I just bought a Fortigate to migrate our entire Mikrotik network to Forigate and the following question arises:
How can you have 4 Subnets on a single LAN port?
Example:
192.168.1.1/24
172.16.50.1/24
192.168.1.1/24
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hey Toshi, jcvm,
multiple IPs can be set in GUI if the interface role is specified as "LAN" :)
Hope this helps.
@jcvm - If you are just looking to set secondary IPs, the above will provide what you need. If you want to include different VLANs for the different subnets, you need to create VLAN interfaces under Network > Interfaces, bind them to the correct physical interface (which will act as trunk port) and set the appropriate VLAN IDs.
Cheers!
I didn't know this until now but at least with 6.4 looks like you can enable Secondary-IP only via CLI. Then you can add those IPs in GUI.
config sys int
edit xxx
set secondary-IP enable
next
end
Hey Toshi, jcvm,
multiple IPs can be set in GUI if the interface role is specified as "LAN" :)
Hope this helps.
@jcvm - If you are just looking to set secondary IPs, the above will provide what you need. If you want to include different VLANs for the different subnets, you need to create VLAN interfaces under Network > Interfaces, bind them to the correct physical interface (which will act as trunk port) and set the appropriate VLAN IDs.
Cheers!
@Debbie_FTNT Thank you very much, I have another question.
Can you create rules and outputs for different WANS to each subnet (secondary IP)?
You can create different rules for each subnet on the interface, yes - if you create policies and always mention the specific source or destination subnet.
You would have four policies from your lan interface to whatever destination, and for each rule you would have a different source subnet defined, for example.
The key would be to never use a generic source/destination (like 'all') that more than one subnet on that interface would match, unless explicitly intended.
To be honest, I am not entirely sure how FortiGate would handle traffic from one subnet to another one on the same interface, if it would allow that without policy or not, you might need to test if you can ping from one subnet to the other without a rule in place.
I would recommend VLANs instead if you want to do more on each subnet, then control the tagging at your switch. Using different subnets on the same interface hinder your ability to debug and manipulate flow of packets down on the road.
Hello,
@Debbie_FTNT I'm going to run these tests to see how the equipment performs.
@Toshi_Esumi I cannot apply Vlans since the network distribution (Physical structure and ports) do not allow me to separate correctly to apply Vlans.
The Subnets are divided as follows:
1- Administrative Teams
2 - IP Phones
3- Cameras
4 - IT team
The ideal would be to use Vlans but the use of it is complicated by the aforementioned.
All I have left are the rules for separating and blocking traffic.
If you have another suggestion, it is accepted.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1547 | |
1031 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.