Non-FortiLink interfaces should not have multiple VLANS configured on them
The specific model we are working with is a FortiGate 100F.
We usually have our Internal Interface configured with the internal network subnet. Then, we’ll have a VLAN sub-interface for Guest Network, and another VLAN sub-interface for the Accounting department network. VLAN 20, and VLAN 30 respectively. So, both of these VLANS show up under Internal Interface when we expand it.
Our HPE network switch is connected to LAN1 which is a member of the Internal Interface. The network switch is aware of the VLANS and is passing them accordingly.
When we run the ‘Security Rating’ tool on our FortiGate, we get the following warning:
ND05.2: Non-FortiLink interfaces should not have multiple VLANS configured on them.
Traffic is flowing properly and everything seems to be working as expected. Why is this against Fortinet best practices? Or, are they simply just trying to get me to use their expensive hardware switches?
Do I really need to configure 3 ports on the firewall and connect all 3 to the network switch? What is the reason for this? The VLAN subinterfaces are being recognized and everything appears to be working just fine.
Likely reduce traffic on both ports in some degree compare to putting them on the same hard-switch. Also it would reduce the chance of L2 loop down stream of the ports if they are connected to switches.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.