Move interface vlans to forigate

[rezafathi]

Hi

Currently, all interface vlans are on cisco 3750 switch and I want to move all interface vlans to fortigate. I have created all sub-interfaces on fortigate but do not know how to move them all to fortigate. Also what should i do about switches vlan ? All access switches's default gateway is the interface vlan on 3750.

[BSeklecki_GE]

The topic of migrating VLANs I'll let others answer; that's an ICND1 question.

Design-wise: When/Once that you have migrated all of the Layer3 interfaces off-of/from the 3750, you:

1) Disable the Layer3 stack with "no ip routing"

2) The 3750 becomes a Layer2 switch with only one Layer3 interface for Management access.

2.1) Or, if it is a 3750X , you can cable the management port in the rear to a dedicated OOB access switch and migrate the management IP to the physical mgmt port.

3) All Layer2-only switches in a network normally have their management-only IP address in a private VLAN not accessible to any other elements (ideally in a private VDOM or private VRF, only reachable by Administrator workstations and NMS servers through strict IP ACL provisions.)

Whatever IP you're currently using to manage the 3750, it is probably one of the Gateway addresses that you'll migrate to the FortiGate (a .1 address in a /24 size VLAN), so you'll have to assign a new IP in the new dedicated switch mgmt VLAN discussed above.

[rezafathi]

Thanks a lot.

1- Should i delete all interface vlans on 3750 or using no ip on every interface is enough?

2- i should create an ip on fortigate sub interface for 3750 and other L2 swiches gateway. Is that right?

3- I have a vlan created for fortigate mgmt port only and because of ip duplication i can not move that to fortigate. So can i leave on 3750?

4- the fortigate connects to a 2960G switch and it then connects to 3750. So i should config one of 2960 ports as trunk. Right?

[ndumaj · Accepted solution]

Hello Rezafathi,

1- Should i delete all interface vlans on 3750 or using no ip on every interface is enough? --> you can use no IP that should be fine

2- i should create an ip on fortigate sub interface for 3750 and other L2 swiches gateway. Is that right? --> Not clear, but you need to create sub interfaces (VLANS ) on FGT interface where the 3750 is connected

3- I have a vlan created for fortigate mgmt port only and because of ip duplication i can not move that to fortigate. So can i leave on 3750? --> you cannot move that at FGT at all so you have no other choice.

4- the fortigate connects to a 2960G switch and it then connects to 3750. So i should config one of 2960 ports as trunk. Right? --> Right

-BR-

[rezafathi]

Hi ndumaj,

Thanks a lot. Regarding question 3, after issuing "no ip" and "no ip routing" on 3750, only the switch vlan and mgmt vlan (mgmt port related vlan) could be left on switch without any probelm right?

[ndumaj]

Yeap correct, that works.

Thanks
-BR-

[rezafathi]

is that right?

[rezafathi]

Any help?

[thomashagaman]

I am trying to moving all the SVI's from a Nexus to the FortiGate, does anyone know of a good resource to read for research?

Any help is greatly apprciated.

Tom