Is it possible to configure two different physical interface on Forti 60F to handle traffics?

[ron_mnap]

My concern is: we have one physical Forti 60F that currently run the following network: 192.168.20.0/24 on port 2 connected to Cisco Switch1 and  We are looking to run 10.21.20.0/24 network on port 5 trunking with Cisco Switch2 

Once I try to connect the Fortigate port 5, it seems like, we lose internet from other network. I'm wondorring if it's something that can be done from this way. Do I need to run on different VDOM? or it could work like I did. Any help will be greatly appreciated.

[Toshi_Esumi]

Most likely there is an L2 loop through port2<->SW1<->SW2<->port5 for non-tagged interface or Vlan1 on Cisco SWes. You either need to get rid of connections between two switches (likely you can't), or remove either or both of port2(internal2) and port5(internal5) from the default VLAN switch interface.

Toshi

[ron_mnap]

Thank you for sharing you help, but I don't have connection between SW1 to SW2, here is my diagram

[Toshi_Esumi]

Are they "internal2" and "internal5" separated interfaces, not bound in "internal" VLAN switch interface? Or is 10.21.20.0/24 is on a VLAN interface? Please share the interface config for those hopefully in CLI.

Toshi

[ron_mnap]

Internal2 is configured as Access port from SW1==>FG port2, there is no vlan, no sub interface implemented; then we want now to implement sub interface with multiple VLAN  by using Port5 ===> TRUNK SW2. 

Sorry, I disconnect all connection on the port so I'm not able to get CLI right now.

[Toshi_Esumi]

As I mentioned before, by default all internal1 - internal5 are in "internal" vlan switch interface. Then when you create the VLAN interface on "internal" (you can't configure it only on "internal5") then the VLAN is shared with all 5 ports. That's why I'm asking the actual config under "config system interface" whenever you can.

Toshi

[ron_mnap]

Sounds correct, thank you Toshi. here is the config

config system interface
edit "wan1"
set vdom "root"
set ip 24.52.52.17 255.255.255.252
set allowaccess ping https ssh http
set type physical
set alias "wan1"
set lldp-reception enable
set lldp-transmission enable
set monitor-bandwidth enable
set role wan
set snmp-index 1
next
edit "wan2"
set vdom "root"
set type physical
set role wan
set snmp-index 2
next
edit "dmz"
set vdom "root"
set ip 192.168.3.1 255.255.255.0
set allowaccess ping https fgfm fabric
set type physical
set alias "dmz"
set role dmz
set snmp-index 3
next
edit "internal1"
set vdom "root"
set ip 192.168.50.1 255.255.255.0
set allowaccess ping https ssh http fgfm fabric
set type physical
set alias "lan1"
set device-identification enable
set lldp-reception enable
set lldp-transmission enable
set monitor-bandwidth enable
set role lan
set snmp-index 4
next
edit "internal2"
set vdom "root"
set ip 192.168.85.1 255.255.255.0
set allowaccess ping https ssh http
set type physical
set alias "lan2"
set device-identification enable
set lldp-reception enable
set lldp-transmission enable
set monitor-bandwidth enable
set role lan
set snmp-index 5
next
edit "internal3"
set vdom "root"
set type physical
set snmp-index 6
next
edit "internal4"
set vdom "root"
set type physical
set snmp-index 7
next
edit "internal5"
set vdom "root"
set type physical
set snmp-index 8
next
edit "a"
set vdom "root"
set type physical
set snmp-index 9
next
edit "b"
set vdom "root"
set type physical
set snmp-index 10
next
edit "modem"
set vdom "root"
set mode pppoe
set status down
set type physical
set snmp-index 11
next
edit "naf.root"
set vdom "root"
set type tunnel
set src-check disable
set snmp-index 12
next
edit "l2t.root"
set vdom "root"
set type tunnel
set snmp-index 13
next
edit "ssl.root"
set vdom "root"
set type tunnel
set alias "SSL VPN interface"
set snmp-index 14
next
edit "internal"
set vdom "root"
set mode dhcp
set type hard-switch
set stp enable
set snmp-index 15
next
edit "vpn.wan1"
set vdom "root"
set ip 0.0.0.0 255.255.255.255
set type tunnel
set monitor-bandwidth enable
set snmp-index 16
set interface "wan1"
next
edit "vlan5"
set vdom "root"
set ip 10.27.27.1 255.255.255.0
set allowaccess ping https ssh http
set alias "gestion"
set device-identification enable
set role lan
set snmp-index 17
set interface "internal"
set vlanid 5
next
edit "vlan25"
set vdom "root"
set ip 10.26.26.1 255.255.255.0
set allowaccess ping
set alias "VoIP"
set device-identification enable
set role lan
set snmp-index 18
set interface "internal"
set vlanid 25
next
edit "vlan21"
set vdom "root"
set ip 10.25.25.1 255.255.255.0
set allowaccess ping
set alias "dataPC"
set device-identification enable
set role lan
set snmp-index 19
set interface "internal"
set vlanid 21
next
edit "vlan22"
set vdom "root"
set ip 10.22.22.1 255.255.255.0
set allowaccess ping
set alias "dataPrinters"
set device-identification enable
set role lan
set snmp-index 20
set interface "internal"
set vlanid 22
next
edit "vlan23"
set vdom "root"
set ip 10.23.23.1 255.255.255.0
set allowaccess ping
set alias "dataMills"
set device-identification enable
set role lan
set snmp-index 21
set interface "internal"
set vlanid 23
next
edit "vlan24"
set vdom "root"
set ip 10.20.20.1 255.255.255.0
set allowaccess ping
set alias "wifi"
set device-identification enable
set role lan
set snmp-index 22
set interface "internal"
set vlanid 24
next
edit "vlan40"
set vdom "root"
set ip 10.10.10.0 255.255.255.0
set allowaccess ping
set alias "wifiPub"
set device-identification enable
set role lan
set snmp-index 23
set interface "internal"
set vlanid 40
next
end

[ron_mnap]

My current main network is on P1 and looking to create P5 with sub interfaces

[Toshi_Esumi]

The potential problem I see in your inteface config is "internal" vlan switch still exist and all VLANs are on "internal" interface.

Go to "config sys virtual-switch" then "show" to see the members of "internal" vlan switch.

[ron_mnap]

Here is 

NAP-000270 (virtual-switch) # show
config system virtual-switch
edit "internal"
set physical-switch "sw0"
config port
edit "internal5"
next
end
next
end