Multiple Software Switch

[kulas]

Hi All,

Good day!

Is multiple software switch configuration be possible on Fortigate 90D running on v5.4.4? For example, Ports 1 and 2 are a member of 192.168.1.1 and Ports 3 and 4 are a member of 192.168.2.1. If Yes, how would I do it on Fortigate? Thank you!

Best Regards.

[Philippe_Gagne]

Hi,

yes you can do it. But I suggest using "hardware switch" than "software switch". Software switches are managed by the CPU, in hardware switch you will have full switching throughput between member ports. 

I have a 70D in my lab, I have 5 hardware switches in it. Port 1&2 in lan1, port 3&4 in lan2 and so on.

To create a hardware switch (or software switch), you have to free the choosen ports from everything... I mean:

- no IP address

- no DHCP

- not member of a interface (switch)

To see what is using the ports, in "Network \ Interfaces", you can take a look in the "Ref" column. Click on the number, you will see "where used". 

Other thing to take care: not all model permit the uses of hardware switches. 90D can!

Philippe

[kulas]

Hi Philippe,

Thank you for this. In doing so, it will be configured using CLI commands or it is visible on the Fortigate's GUI? Sorry for asking coz I don't have my Fortigate with me in my laboratory. 

Best Regards.

[Philippe_Gagne]

Hi,

As far I remember, you're suppose to be able to do it in GUI. In "Network \ Interfaces". Click on "Create New", choose "Interface". In the next windows, in Type, choose the switch interface you need. If no free ports are available, all interfaces are used somewhere else.

If you prefer to do it in CLI. We have to create "hardware switch", the L2 part first:

config system virtual-switch

edit "lan"

set physical-switch "sw0" config port

  edit "internal1"

  next

  edit "internal2"

  next

end

next

end

Then, configure L3:

config system interface edit "lan" set vdom "root" set ip 10.250.211.254 255.255.255.0 set allowaccess ping https ssh set type hard-switch set alias "Lab1 LAN1" set device-identification enable set role lan next

end

Let me know if you need something else! :)

Philippe

[kulas]

Hi Philippe,

Thank you very much. This much appreciated. I will try those configurations once the Fortigate in our Lab is available.

Best of regards!