Setting Fortinet 60D interface ports for Trunk and Access VLANs

[ragno]

Hello!

I have a Fortinet 60D on a multi-VLAN network environment. Is it possible to make the bellow settings, where port 1 is for all VLANs trunk, and the others ports I can choose what vlan to assign?

PORT 2 (vlan 10)-----DESKTOPS | | PORT 3 (vlan 20) ------SECURITY CAMERA | | | | PORT 4 (vlan 20)------SECURITY CAMERA | | | | | | PORT 5 (vlan 50) ------WIFI | | | | ::::::::::::::::::::::::::::::::::::::::::::::::::::: :::::::::: FORTINET FIREWALL :::::::::: ::::::::::::::::::::::::::::::::::::::::::::::::::::: | PORT 1 of Fortinet (TRUNK PORT) | | | <<< TRUNK CHANNEL (with all vlans passing throught 10,20,50) | | SWITCH (L3, ROUTING ENABLED) | | ...rest of the network...

[rwpatterson]

Silly question... Have you checked off 'NAT' on the policies facing the Internet? Your ISP will not permit traffic out that does not have a public IP address. That will display the same symptoms as you are describing, but the problem is not in your scope of posts.

My two cents.

[rwpatterson]

Trying to get a handle on the HP. If you pull the connection to the Fortigate, can devices on the 192.168.10.x network contact the devices on the second 192.168.20.x network?

If yes, then you only need one default route, and the VLAN stuff you're trying to set up is extraneous. If they see each other, then they can ride down a single pipe to the Fortigate. (additionally as Emnoc suggested, route the traffic to the Fortigate with a transit subnet)

If no, then you are heading down the right path. They cannot see each other and you do need to handle both VLANs individually.

My two cents

Please let us know

By the way, can each subnet PING it's individual gateway?

Also, not a PPPoE pro, but shouldn't the subnet be larger than a single device?

[ragno]

rwpatterson wrote:

...

By the way, can each subnet PING it's individual gateway?

Also, not a PPPoE pro, but shouldn't the subnet be larger than a single device?

A machine 192.168.20.10 on vlan 20 pings ok to:

- 192.168.20.1 (hp gateway) - 192.168.10.1 (hp gateway)

- 192.168.10.10 (pc)

- 192.168.10.254 (firewall ip)

A machine 192.168.10.10 on vlan 10 pings ok for:

- 192.168.20.1 (hp gateway)

- 192.168.10.1 (hp gateway)

- 192.168.20.10 (pc)

- 192.168.10.254 (firewall ip)

 

[rwpatterson]

If the pings between the VLANs are with the Fortigate cable pulled, then the HP should be routing to the Fortigate and the trunking is irrelevant. Think about it. No Fortigate but communication still works = HP is routing...

[emnoc]

agreed

The OP needs to define if he's doing intervlan routing on the HP or  Fortigate. If he needs to  filter traffic between vlans on the firewall, he will need the layer3 routing on the  Fortigate for the defines he listed earlier.

[ragno]

After I tryed many different settings to be able to vlans get the Internet, I downgraded my Fortigate from 5.2.2 to 5.0.10 Build 305 and the internet back to work to all vlans without I make other settings.

The HP is doing the interVlan routing. 

Correct if I am wrong, but if I want to filter VLANs I need to use the ACL in HP right?

[jackotieno]

Hello Ragno,

I need your assistance in setting up Multiple VLANs on Fortigate 300C. This is how my setup is;

Netgear GSM7328FS connecting to Fortigate which forward traffic to ASA Firewall. Currently I have /16 block which I want to Subnet to many VLANs. For a test, I've created IP Based VLAN - in 192.168.x.x while the Firewall, Switches and Other devices are on 176.16.x.x block.

I'm able to ping 192.168 within the switch, but when I introduce the Fortigate, I'm unable to ping devices on 192.168.x.x. How should I set up my configs on the Fortigate so that I can browse using either 192.168.x.x and/or 17616.x.x

Thank you.

With Regards,

Jack Otien