I want to use Network Design by creating Vlan routing on Fortigate 200D. Possible or not ?

[aunghtunoo]

Hi everyone,

I want to use a network design as download link to redundancy to each Distribution Layer switches by only creating vlans (SVI or Int Vlan Routing method) on FortiGate 200D. Is it possible or not ?

You can see my requirement design in Attached.

Actually, when I testing vlans creation to use on two Etherchannel link to Distribution Layer Switches.

But Vlans can be created on fortigate however only can choose a vlan on one Etherchannel link otherwise cannot choose a vlan on both two Etherchannel link.

So, How can I use another way with redundancy design by creating vlans on fortiGate to Distribution Swithes ???

Pls suggest me how to design to my network by using vlans on fortigate.

Thanks so much all.

aunghtunoo14@gmail.com

       

[gschmitt]

For this it would be easiest to remove all policies beforehand

If you want to distribute a VLAN among multiple interfaces you need to put them in a software switch.

Go to System > Network > interfaces

If your ports are listed individually skip ahead.

If they are listed as something like "internal" remove all policies/dhcp/etc referencing them

Right click the internal > Change Mode and select Interface instead of Switch

Now you need to create software switches for your VLANs.

If I understand your picture correct you want 2 different networks (internal and DMZ) with 2 switches each and redundant connections to the internal switches.

Again in System > Network > Interfaces select Create New

Name "Internal"

Type: Software Switch

Physical Interface Members: add at least 4 ports

Configure the rest as needed

configure an aggregated link (802.ad)

(you could use this as VLAN_lan since it's techically VLAN ID1 default)

Repeat this for "DMZ" but only add 2 ports

(again, this is technically vlan_dmz with ID 1)

Now select Create New

Name: "vlan_LAN"

Type: VLAN

Interface: "Internal" (the one created above)

VLAN ID: your VLAN ID (needs to match the switches)

Configure the rest as needed and repeat for all other VLANs

The DMZ VLANs need to have Interface: "DMZ"

NOW at Policy & Objects > Policies > IPv4 you can create policies to allow access from/to the different vlans as needed, select the VLAN Interface names as Source/destination Interface

[emnoc]

For this it would be easiest to remove all policies beforehand

It really depends. if he has the ports availability even if not the 2nd redundant member he could craft the new L3-subinterface and over that bundle.

Than change the routing to accept traffic from the local vlans at the distribution layer AFTER creating the new policies. I've done this like a  thousand or more times.

 So if the gateways of vlan_wifi/lan/peripherals are on the distribution-layer switches  than this is cut and dry, if not than you have more work.

FWIW;  one of the new trends is to enable lacp always even if it's with one member so if you later design or add redundancy in your configuration, you have less work. This is even true imho with lower end units that don't have a lot of ports to begin with. It's always easy just to add member #2 or #3 or #4 etc... after you have the based 803.ad or static bundle defined.

Just keep in mind  the smaller SMB firewall models typically don't support  lacp/bundles YMMV

[gschmitt]

emnoc wrote:

Just keep in mind  the smaller SMB firewall models typically don't support  lacp/bundles YMMV

I think it's 110 and lower who don't support lacp

The 200D supports it

[aunghtunoo]

I got have the solutions.

I use Redundancy Type to interface to two downstream Distribution Switches.

Then all vlans can pass through over these links that is simple for me.

Thanks so much to all.