Is it possible to create a non-monitored VLAN on a fortiswitch which is fortilinked to a fortigate?

[jcbroomfield]

Hi all,

I have a setup with 2x FG-200F (HA) and 2x FS-1048E, with other switches hanging off the FS-1048 which acts as my core switching infrastructure.

The 2x FS-1048E are controlled from the Fortigates, via fortilink.

I believe that all the FS-1048E's traffic on any port gets inspected by the FG.

I have a Vmware VSAN platform which I want to connect to the FS-1048E's with some ports dedicated exclusively to the VSAN traffic (storage traffic between the hosts, which I do NOT want inspected and under no circumstances have any possiblity of it being blocked).

As the VSAN traffic demands high speed and low latency, I'm guessing that having it inspected (even if I have rules that say "do nothing") will a) introduce some latency and b) eat up CPU on the FG.
Is there anyway I can have a VLAN defined on the FS1048E that stays at layer-2 on the fortiswitch and thus has low latency/high bandwidth?

Thanks in advance.

[gfleming]

Assuming there is no L3 routing for the VSAN traffic (i.e. it's all in the same VLAN) then yes just create a VLAN on the FGT for VSAN. You can assign an IP address if you want but you don't need to. All traffic will traverse your switches as L2 and bypass the FGT.

If you require L3 routing it has to go through FGT. In which case it might make sense to configure your FS-1048E's as standalone L3 switches and use FortiLink for the edge switches.

[jcbroomfield]

Hi Graham,

The reason I asked the question is that, as I understand it, when the fortiswitch is managed through fortilink by the fortigate, all the traffic on each port gets inspected by the fortigate, regardless of if it is all L2 in the same vlan.

So, If I create (on the FGT) a specific VLAN for my VSAN which includes (for example) ports 1 through 8 on the fortiswitch, and then connect my 4 VSAN hosts with 2 ports per host and have them communicate amongst themselves, although the traffic will go through, and from a functional point of view it will be the 8 ports communicating amongst themselves, the reality is that these ports will be getting inspected by the fortigate (either the FSW sending traffic up and then the FGT sending back down, or info on the traffic flows, or whatever...).

I'm looking for a) confirmation that by default it works how I think [which actually limits the throughput], and b) a way to have the traffic really stay on the FSW and not be interacted by the FGT.

Regarding having the FS-1048E's act as standalone, I actually need them to act as core switching to connect around 15 other FS.

tnx,

John.

[gfleming]

Hey John,

Yes that's what I confirmed in my previous response. If there is no inter-VLAN traffic, that is traffic that is within the same VLAN, it will get switched at L2 by the FortiSwitch and bypass the FortiGate.

The only traffic that gets inspected by FortiGate is inter-VLAN traffic.

You can configure a FSW to be standalone (i.e Not managed by FortiGate) and still connect other switches to it and those other switches can be managed by FortiGate using FortiLink over L3.