Interfaces and VLANs

[ITadm]

Hello, 

 In all of my locations I'm using managed switches, so I only have to create VLAN interfaces for one of the ports and switch sends tagged traffic to one of the virtual interfaces. Now I have one exception and I need to configure everything without a switch. I need to connect my FortiGate 30E to an Access point with 3 different SSIDs (3 VLANs), a printer and VoIP telephone, so I need 4 VLANs + WAN to do this. With a switch, I'd just create some VLANs on specific ports and switch would do the magic with tagged and untagged ports.

I can see that there are:

-Loopback interface

-Hardware switch

-Software switch

-WiFi SSID

-PPPoE

-EMAC VLAN

I couldn't find a cookbook on Forti youtube that explains what's the difference between them. Can you guys give me a clue how to do this?

[Jirka1]

Hi,

30E does not allow VLAN configuration using GUI. You'll need to do this with CLI:

config system interface edit <vlan name> set vlanid <1-4094> set interface <> end

config system interface edit <vlan name> set ip <IP address> <Network mask> end

Jirka

[ITadm]

Hi Jirka, 

 Thanks for your response, I can create VLAN from GUI:

The case is I need to use for example:

port 1 vlan 1,2,3

port 2 vlan 1

port 3 vlan 4

Port 1 is for AP with different SSIDs, one VLAN for each.

[Jirka1]

ah, I understand. You can not have the same VLAN on multiple ports. I do not see a problem in the other settings. Simply create the VLAN with the desired number and add it to the port. Continue with all the VLANs you need.

Jirka

[ITadm]

And how about the AP? I usually configured it on switch

SWITCH

port 1 FG - vlan 1,2,3,4 tagged

port 2 AP - vlan 1,2,3 tagged 4 untagged for management

When I create 3 vlans on 1 port for a 3rd party AP which works on switch as above and supports VLANs, will it work? I need to connect it directly to the port on FG. I'm asking in advance, because I can only configure it on site with limited time. Thanks!

[Jirka1 · Accepted solution]

If you enter an IP address on the port under which you have VLANs, it behaves like an untagged port.

So, for example, set:

port1 192.168.1.1/24 will be untagged (vlan1) vlan2 192.168.2.1/24 will be tagged as vlan2 vlan4 192.168.3.1/24 will be tagged as vlan3 vlan4 192.168.4.1/24 will be tagged as vlan4

Jirka

[ITadm]

Works like a charm, thank you!