Separate LAN hosts

[MarcMoe]

Hello,

i have similar needs as described here:

https://forum.fortinet.com/tm.aspx?m=151527&tree=true

I have hosts on a vlan which i want to separate.

I do not want to change the HOST IP. At the moment hosts are in one vlan. 

so i have created a vdom in transparent mode.

i have added 2 VLANS (VLANID 990 and 991) to Fortigate Ethernet Port3. 

I have connected this fortigate port to switch port (HP Procurve).

I have configured the switch port to tag VLAN 990 and 991 (similar to CISCO trunk port).

i have configured 2 other  switch ports with untagged VLAN 990 and vlan 991 (similar to cisco access port).

On every untagged/access port a devices with IP (within same subnet) connected. 

Both devices can not directly communicate, so the traffic should go to the trunk port which is connected to the fortigate.

On the fortigate i have configured 2 policies to allow any traffic from "VLAN990 to VLAN991" and "VLAN991 to VLAN990".

But there is no communication possible.

I have added a forwarding domain (ID 11) to both interfaces, VLAN990 and VLAN991.

But also no traffic possible.

I thought this could be possible, after i read the forum entry mentioned at the beginning. 

Maybe somebody can help me? 

Regards

Marc 

[rwpatterson]

MarcMoe wrote:

Hello,

i have similar needs as described here:

https://forum.fortinet.com/tm.aspx?m=151527&tree=true

I have hosts on a vlan which i want to separate.

I do not want to change the HOST IP. At the moment hosts are in one vlan. 

Welcome to the forums.

At this point, I believe your issue lies at the last line I quoted you in. Since the IPs are in the same subnet, the FGT cannot route the traffic. Each VLAN is on a separate virtual interface and the only way to cross these interfaces is with routing and policies. There is no clean workaround for this aside from changing the IP addresses and VLAN subnets.

[MarcMoe]

Hello,

thanks for your reply.

I also thought this could not be possible, but i have found this in the thread i mentioned:

I have this kind of setup on one of my boxes. I believe this is refered to as a VLAN translation setup. Here is a quick simplified overview... You have your "normal" unsecured, everything else VLAN. You then also have one or more "secured" vlans depending on your segregation needs. You have a fortigate operating in transparent mode connected to a switch. On that switch, you have devices plugged into ports that are ONLY allowed to use one vlan. So your users and upstream routers are connected to vlan 1, a web server on vlan 2, and database on vlan 3 (for example). The web server switch port is only allowed vlan2, the database port is only allowed vlan3, and all other ports are only allowed vlan1. You then have your fortigate plugged into the switch on a trunk port that is allowed vlan 1, 2, and 3. You create rules that state users can connect from vlan1 to vlan2 to the web server on appropriate ports. The web server can connect to the backend database from vlan2 to vlan3 on appropriate ports, but users on vlan1 cannot talk to the database due to an implicit deny. What happens is that in transparent mode- the firewall will advertise mac addresses across all interfaces. So your web server on vlan2 cannot see any other devices because only it and the firewall sit on vlan2. The firewall advertises that it has routes to all other mac addresses on the local network and therefore traffic can flow. The same holds true in reverse for users to get to the web server as long as appropriate firewall policies are in place. Doing it this way allows you to scale your setup as you can just add more ports to the secured vlan and protect more servers behind the firewall without every changing any ip settings. The caveat is that the machines on the same vlan have unrestricted access to each other and you will eventually need aggregated interfaces to make sure you have enough throughput. You can also do this in a cheap fashion by directly connecting the devices to the physical interfaces on the firewall and forgetting about vlans- but it doesn't scale.

I hope there is a way to configure such a scenario.

I have tried to rebuild the scenario on the description, switch trunk port, configuring the vlans on transparnet Fortigate VDOM and adding policies. 

Maybe i misunderstood something, or the Fortigate behaviuor is different in the FortiOS releases (disabeld feature by default in newer OS?).

I have also seen a KB article which mentions "remapping VLAN IDs" with forwarding domains.

[size="2"]http://kb.fortinet.com/kb/documentLink.do?popup=true&externalID=FD32877&languageId=[/size]

I know, changing the IPs from hosts would be best solution, but this is not possible for different reasons :(

Regards

Marc