[Question]Best way to setup Fortigate between Cisco Switch & Cisco Router.

[TheLordOfTheShells]

Dear All,

I just bought a new fortigate firewall and want to intergrate with our old system has allready run. I'm quite new with fortigate so hope you guys will help for the best way to settup. For a brief overview.

1) 4321 cisco router connect to ISP 2) 3850 cisco switch has several Vlans and intervlan routing also being run on its. 3) 3850 Switch's default route will point to 4321 cisco router.

So now the question is if we need to install fortigate as firewall between cisco router and Sw Core how we can simply the config to the best way. We change the Topo and Ip to meet the best configuration so do not care much about the topo now.

[rohitchoudhary1978]

Hi,

Connect CISCO 4321 [the wan router] to fortigate wan port and from FGT lan port connect the cisco switch with switchmode trunk port. Configure fortigate lan port with sub vlan id and the gateway ip. Create interface with port and select vlan and type vlan id and the necessary gateway ip address. Create the necessary policies for lan usage and the firewall is ready to work.

Thanks

Rohit

[LUKE_LUCAS]

Hi we purchase 60e , and the management wants to add the 60e on our existing network...

i have a plan topology can you help me about my concern

thanks.

i attach a file.

[TheLordOfTheShells]

Thank you for all the advices.

After some research, there are some comment told me that Vlan should not be configured on Fortigate, Vlan on Switch layer 3 instead. After all I have configured all vlans on Switch layer 3, default route point to firewall and configure static route between firewall and router. I work fine now but I wonder is there any bad result here?

I really appreciate all your support.

[TheLordOfTheShells]

Hi guys.

So now I have some problems with port forwarding. I have a server on Vlan 10 need public to internet. After some configuration but not successed at all, here are steps that I has made

1. Static NAT server on router: ip nat inside source static tcp 10.10.10.100 80 interface Dialer 1 8080

2. Allow traffic from outside to server on Fortigate.

Port status is open (using ping.eu to check port status) but i can not access to server from internet.

Do you guys have any idea for that problems?

Thanks

[Dickie]

Do you need to keep the Cisco 4321?  It would be a far simpler setup to connect the 200E to the ISP?

[TheLordOfTheShells]

Hi Dickie

Thanks for your response.

Because of company policies I can not remove cisco 4321 now, I think i have some misconfiguration on Fortigate, but do not know exactly what it is =/.

[Dickie]

OK that is a shame.  You should not have the Firewall doing NAT in that case - check that, you will need a policy from WAN to LAN allowing traffic to your server, and all the routing in place.

[TheLordOfTheShells]

Dickie wrote:

OK that is a shame.  You should not have the Firewall doing NAT in that case - check that, you will need a policy from WAN to LAN allowing traffic to your server, and all the routing in place.

Yes like you said I'm not doing NAT on Firewall site, just allow traffic from Router to Server through Firewall but feel like there is something wrong on Firewall.

On Firewall, I do not have much work on that now, just static route, allow traffic from LAN to Router and Router to LAN now.

[rwpatterson]

If you don't have the VLANs trunked between the switch and the Fortigate, how will the Fortigate police traffic? Is it in transparent mode?