Hi guys, i'm new user using fortigate,
I want to know if we implement fortigate on transparent mode, what limitation we can get ?
or any documentation so i can read before i implement fortigate transparent mode.
Appreciate your feedback,
Thank you.
#Fortigate #Transparent Mode
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Transparent mode is a valuable feature of FortiGate firewalls that allows them to be easily integrated into existing networks without requiring any changes to the network topology or IP addressing. However, it's important to be aware of the limitations of transparent mode before deploying it in your network.
Limitations of Transparent Mode:
Limited Layer 3 Features: Transparent mode operates at Layer 2 of the OSI model, which means it doesn't have access to Layer 3 information like IP addresses or routing tables. Consequently, features like NAT, VPN, and certain security features like IP reputation filtering may not be available or fully functional in transparent mode.
Limited Visibility and Troubleshooting: Transparent mode can make it challenging to track and troubleshoot network traffic issues. Since the FortiGate doesn't act as a router, it doesn't have the same level of visibility into network traffic as it would in routing mode.
Increased Complexity for Complex Networks: In complex networks with multiple VLANs or routing domains, transparent mode can add complexity to the network management and troubleshooting process.
Potential Performance Impact: Transparent mode may impact network performance, especially in high-traffic environments. The additional processing overhead of inspecting traffic at Layer 2 can introduce latency and reduce overall throughput.
Considerations for Transparent Mode Deployment:
Network Simplicity: Transparent mode is best suited for simple networks with minimal VLANs or routing domains where ease of deployment is a priority and Layer 3 features aren't essential.
Security Requirements: If you require advanced security features like VPN, IPSec, or sophisticated traffic filtering based on IP addresses or protocols, routing mode may be a better option.
Performance Considerations: In high-traffic environments, transparent mode may impact network performance. Evaluate your network's bandwidth and traffic patterns before deploying transparent mode.
Troubleshooting and Visibility: If you need detailed network visibility and troubleshooting capabilities, routing mode may provide a better overview of network traffic and facilitate easier troubleshooting.
Network Management Complexity: For complex networks with multiple VLANs or routing domains, transparent mode may add complexity to the network management process. Consider the impact on network management before deploying transparent mode in such environments.
Recommendations:
Thorough Evaluation: Carefully evaluate your network's requirements and limitations before deciding whether transparent mode is the right choice for your environment.
Performance Testing: If performance is a concern, conduct performance testing to assess the impact of transparent mode on your network's throughput and latency.
Documentation and Training: Ensure proper documentation of the network configuration and provide adequate training to network administrators to effectively manage and troubleshoot networks in transparent mode.
Consider Alternative Deployment Methods: Explore alternative deployment methods like routing mode or a combination of transparent and routing modes to suit specific network segments and requirements.
By carefully considering the limitations and recommendations, you can make an informed decision about whether the transparent mode is the most suitable deployment option for your FortiGate firewall and network environment.
Hi Rifqi,
Please check the below useful link.
https://docs.fortinet.com/document/fortigate/6.4.0/best-practices/626611/transparent-mode
https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/302871/transparent-mode
Hi Kwan,
Thank for your usefull link that you shared, i still reading it.
Transparent mode checks and forwards the traffic while the unit remains transparent/invisible to the network. This also means it performs no routing (no SDWAN, no VPN, not possible to address it on anoher IP/interface other than management IP). UTM profiles can be used, but that is almost all it can be set up.
Hi Alex,
so when we using transparent mode, we cannot set up SDWAN, sslvpn gateway or putting ip address in interfaces, but we still set up IPS, web filtering, etc in policy/ rules ?
Created on 11-16-2023 01:05 AM Edited on 11-16-2023 01:07 AM
Yes, correct. FortiGate in transparent mode can't terminate or initiate a connection by itself, except through management interface. It's not a very utilized mode as it is quite restricting on the capabilities of the unit.
Here's one more discussion you may want to check:
https://community.fortinet.com/t5/Support-Forum/Fortigate-Transparent-mode-Operating-in-transparent-...
Hello,
I would recommend to check transparent mode administration guide by following the link below:
It also mentions limitations.
Hello Abaruskha,
thank for your recomendation, i will reading it too.
Transparent mode is a valuable feature of FortiGate firewalls that allows them to be easily integrated into existing networks without requiring any changes to the network topology or IP addressing. However, it's important to be aware of the limitations of transparent mode before deploying it in your network.
Limitations of Transparent Mode:
Limited Layer 3 Features: Transparent mode operates at Layer 2 of the OSI model, which means it doesn't have access to Layer 3 information like IP addresses or routing tables. Consequently, features like NAT, VPN, and certain security features like IP reputation filtering may not be available or fully functional in transparent mode.
Limited Visibility and Troubleshooting: Transparent mode can make it challenging to track and troubleshoot network traffic issues. Since the FortiGate doesn't act as a router, it doesn't have the same level of visibility into network traffic as it would in routing mode.
Increased Complexity for Complex Networks: In complex networks with multiple VLANs or routing domains, transparent mode can add complexity to the network management and troubleshooting process.
Potential Performance Impact: Transparent mode may impact network performance, especially in high-traffic environments. The additional processing overhead of inspecting traffic at Layer 2 can introduce latency and reduce overall throughput.
Considerations for Transparent Mode Deployment:
Network Simplicity: Transparent mode is best suited for simple networks with minimal VLANs or routing domains where ease of deployment is a priority and Layer 3 features aren't essential.
Security Requirements: If you require advanced security features like VPN, IPSec, or sophisticated traffic filtering based on IP addresses or protocols, routing mode may be a better option.
Performance Considerations: In high-traffic environments, transparent mode may impact network performance. Evaluate your network's bandwidth and traffic patterns before deploying transparent mode.
Troubleshooting and Visibility: If you need detailed network visibility and troubleshooting capabilities, routing mode may provide a better overview of network traffic and facilitate easier troubleshooting.
Network Management Complexity: For complex networks with multiple VLANs or routing domains, transparent mode may add complexity to the network management process. Consider the impact on network management before deploying transparent mode in such environments.
Recommendations:
Thorough Evaluation: Carefully evaluate your network's requirements and limitations before deciding whether transparent mode is the right choice for your environment.
Performance Testing: If performance is a concern, conduct performance testing to assess the impact of transparent mode on your network's throughput and latency.
Documentation and Training: Ensure proper documentation of the network configuration and provide adequate training to network administrators to effectively manage and troubleshoot networks in transparent mode.
Consider Alternative Deployment Methods: Explore alternative deployment methods like routing mode or a combination of transparent and routing modes to suit specific network segments and requirements.
By carefully considering the limitations and recommendations, you can make an informed decision about whether the transparent mode is the most suitable deployment option for your FortiGate firewall and network environment.
Hi Johnsmith3321,
Thank for your explanation, very insightfull for me.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.