Pairing 2 ports when in interface mode?

[RJMcinty]

I' ve got a 40C running 4.0MR3, with the ports in interface mode. I' ve got 3 different zones physically isolated on 3 different ports, and they' re working fine with DHCP, isolation, routing, etc., which takes up 3 of my 5 ports. I' d like to take the other 2 ports, say, 2 and 3, and pair/bond/team them with port 1 so that they' re all part of the same subnet and can talk to each other, but I' m a bit of a noob, and stuck on how to do this. I could give each one an IP address on separate subnets, along with DHCP servers, and then set up firewall rules to open them up to each other. Or, perhaps I could just give them all IPs on the same subnet (say, 192.168.10.1, .10.2, and .10.3), use the same DHCP server on the .10.1, and then use firewall rules to open them up). But, I don' t know if there' s a more clever, better way to accomplish this. Thanks! Robert

[ede_pfau]

hi, no, no, nothing on Layer 3 necessary. You can combine ports on Layer 2, to form a " soft-switch" . The drawback is that all traffic between member ports will be handled by the CPU and not be accelerated. You can find a lot about this topic on the forum (search for " WiFi" or " soft-switch" ) and a description of the procedure in the FortiOS Handbook. Be aware that this will cost you some effort: in order to be available as a member port a port MUST NOT have any references to it. That is, be used in an address object, a route, a policy, a VIP, .... you get it. One way to do it is to back up the config, factory-reset the FGT, make the change (even then you have to remove some references), edit the config to reflect the new port name, and restore it. Sounds convoluted, and it is. Ports should be combined right at the start. But with patience it can be done.

[ede_pfau]

Now I see you' re working in interface mode anyway so you' ve changed the mode once before. So you know how to do it, just take the reverse path...

[RJMcinty]

Grrr. Thanks! That' s it exactly. The perf hit is disappointing, but understandable. I think that I can pretty easily make this change; I don' t think that I' m referencing any actual interfaces (other than the DHCP server); everything else is abstracted out. Not sure how I didn' t find this sooner. --Robert

[RJMcinty]

Well, that was anti-climatic! :) Downloaded the config file, edited with text editor to create the switch-interface, copied my config info from where internal1 was defined into the new interface config, and find/replace of internal1. One final question (for now!): I' ve got this going on:

 config system switch-interface
    edit " internal1_2" 
       set type switch
       set member internal1 internal2
 end
 config system interface
    edit " internal1_2" 
         set vdom " root" 
         set ip 192.168.xxx.xxx 255.255.255.0
         set allowaccess ping https ssh http fgfm
         set type switch
    next
    edit " wan1" 
     ...
 

Do I need the " set type switch" in the config system interface section? I put it there because there was a " set type physical" when it was just internal1, and it seems to work, but want to make sure. :) Thanks!!! Robert

[RJMcinty]

It looks like it doesn' t matter whether the " set type switch" is in there or not; it always represents the type as " software switch" . Thanks! Robert