Is it possible to put a Fortigate in the middle of a network with arbitrary parts on either side

[wmjosiah]

Hi folks,

I'm replacing a Palo Alto PA-3220 with a Fortigate 3001F. Our Palo is at our research site and it has some things behind it and some things in front of it. It does routing for a few RFC1918's that are behind it, but all the rest of the routing is done on the outside. Arbitrary hosts are behind the Palo in arbitrary subnets and vlans, and other hosts in the same subnets and vlans are not behind it. The Palo seems to handle this just fine using layer 2-only vlan interfaces and I can assign multiple of those to the same zone even though they're on different physical interfaces and then just assign policies based on address and zone and it doesn't care that the subnet is spread across two interfaces - it's not doing the routing anyway... the Fortigate seems to really want subnets to exist on one side of the unit or the other, and I can't have floating VLAN interfaces that aren't attached to any physical interface like you can on most other network devices I've worked with, unless I'm missing something. Is there anyway to tell it not to do routing for particular subnets and just apply policies to traffic across the unit, and then do routing for other subnets? For instance, I want, say, 201.162.80.5, a host in the 201.162.80.0/24 subnet and vlan 80, to be behind the Forti, even though the gateway for that subnet is outside the Forti, at 201.162.80.1 on a vlan80 interface on our router, and also the Forti itself has an address on the outside interface in that subnet and VLAN, at 201.162.80.4 . I cannot figure out how to make it so the Forti knows the gateway for the subnet is on the outside interface but that particular host is inside. Can this be done? Thanks in advance!

[johnathan]

Generally you can only configure one subnet on one interface on the FortiGate. There are exceptions to this, but it is default behavior for a reason. 
 
I think it would be helpful if you have a diagram as it is kinda unclear what you are trying to achieve.

"Is there anyway to tell it not to do routing for particular subnets and just apply policies to traffic across the unit, and then do routing for other subnets?"

From what you described, a Virtual wire pair would work for the traffic which does not need any routing, but still should be inspected: https://docs.fortinet.com/document/fortigate/7.6.3/administration-guide/166804/virtual-wire-pair

It will kinda act like the two interfaces in the wire pair are linked together, so traffic will only flow between the two interfaces. Policies are still required for traffic to traverse the Virtual wire pair, so inspection is applied. This might be what you are looking for?

[wmjosiah]

Sure, it's a bit weird. I would never design a network this way from the ground up, but it's what I was handed, and I want to transition it gradually away from this, but in the meantime... here's a picture of what I want to do. Thanks in advance. I'm pretty sure I might have to use two VDOMs, one in transparent mode and one in NAT mode with different interfaces and what I've drawn here isn't possible... but please let me know if you know of a way to do it!

[sw2090]

I think no matter if you use an LAG Trunk or virtual wire pair one problem persists:

you still can have the vid(s) and subnet(s) only once on the FGT. So they have to be tied to one interface. 

Then Traffic inside the vlan will only hit that interface and will be routed via connected route (and arp table in ipv4). 

This will work so far but you will NOT be able to filter that traffic on your FGT since it only hits the interface but never the FGT itself.

[sw2090]

Alas you can have Zone with different logical/physcial interfaces and use that in policies on a FGT too but still you have the above problems.

[wmjosiah]

Yeah that's pretty much the same conclusion I came to. So I'll have to either get a different firewall or completely redo the network in one go. Thanks very much for your input!