Setting up VLAN on a single subnet

[#1]

Could someone please check if the configuration settings are correct. I am trying to setup 2 VLANs on a clients network with a single subnet. They are using Fortigate-80C as the DHCP server 192.168.1.1/255.255.255.0 and router to the internet. The 3Com 2226 switch has been set with 2 VLANs with one same port tagged on each VLAN (to the Fortigate-80C) and the others untagged to the relevant VLANs. This is the client’s network topo. Configuring the FortiGate-80C unit done below. Start the FortiGate web-based manager to configure the FortiGate-80C unit. Adding VLAN subinterfaces - web-based manager 1 Go to System > Network > Interface. 2 Select Create New. 3 Enter the following information for VLAN_10 and select OK: Name VLAN_10 Interface internal VLAN ID 10 Addressing mode Manual IP/Netmask 0.0.0.0/0.0.0.0 Administrative Access HTTPS, PING, TELNET Configure other fields as required. 4 Select Create New. 5 Enter the following information for VLAN_20 and select OK: . Name VLAN_20 Interface internal VLAN ID 20 Addressing mode Manual IP/Netmask 0.0.0.0/0.0.0.0 Administrative Access HTTPS, PING, TELNET Configure other fields as required. Adding the firewall addresses - web-based manager You need to define the addresses of the VLAN subnets for use in firewall policies. The FortiGate unit provides one default address, “all”, that you can use when a firewall policy applies to all addresses as a source or destination of a packet. 1 Go to Firewall > Address. 2 Select Create New. 3 Enter the following information and select OK: Address Name VLAN_10_Net IP Range/Subnet 192.168.1.0/255.255.255.0 4 Select Create New. 5 Enter the following information and select OK: Address Name VLAN_20_Net IP Range/Subnet 192.168.1.0/255.255.255.0 Adding the firewall policies - web-based manager 1 Go to Firewall > Policy. 2 Select Create New. 3 Enter the following information and select OK: Interface/Zone Source: VLAN_10, Destination: VLAN_20 Address Name Source: VLAN_10_Net, Destination: VLAN_20_Net Schedule Always Service ANY Action ACCEPT NAT Select Configure other fields as required. 4 Select Create New. 5 Enter the following information and select OK: Interface/Zone Source: VLAN_20, Destination: VLAN_10 Address Name Source: VLAN_20_Net, Destination: VLAN_10_Net Schedule Always Service ANY Action ACCEPT NAT Select Configure other fields as required. 6 Select Create New. 7 Enter the following information and select OK: Interface/Zone Source: VLAN_10, Destination: external Address Name Source: VLAN_10_Net, Destination: all Schedule Always Service ANY Action ACCEPT NAT Select Configure other fields as required. 8 Select Create New. 9 Enter the following information and select OK: Interface/Zone Source: VLAN_20, Destination: external Address Name Source: VLAN_20_Net, Destination: all Schedule Always Service ANY Action ACCEPT NAT Select Configure other fields as required.

[rwpatterson]

You cannot route between different interfaces bearing the same subnets. What are you trying to accomplish here?

[#3]

Hi Bob Thanks for the reply. I am trying to setup 2 VLANs in a single subnet. Need the 2 VLANs to share network resources eg DHCP server, NAS, router, print server. Chris

[rwpatterson]

Why even bother with VLANs? Is there a need by manglement? (intentional misspelling )

[#5]

My client has a public WIFI network for students which they want to separate from their own internal network. However the students and the office need to share the same internet router. The organisation have limited resources and would like to use only a single DHCP server, NAS, print server etc..

[rwpatterson]

Each VLAN on the FGT can have it' s own DHCP server, subnet and unique access to the Internet without seeing each other. What interaction they all have depends solely on the policies.

[SECCON1MC]

All interfaces on a fortigate must be on their own subnet. You cannot have a VLAN10 interface and a VAN20 interface with the same ip/subnet. Your best bet might be to change the IP scheme and use NAT (this is messy but would work).

[#8]

My client has a public WIFI network for students which they want to separate from their own internal network. However the students and the office need to share the same internet router. The organisation have limited resources and would like to use only a single DHCP server, NAS, print server etc..

Hello, I' m sorry to tell that but this design just doesn' t make any sens. Two DHCP services on the Fortigate 80C just doesn' t consume any ressource at all. You can still share network ressources such as NAS, print server, and so on with workstations deployed on two different subnet. If you put your students and your office workstation on the same subnet, your Firewall will never have a chance to filter or protect or do whatever to separate the traffic between them. Now if you have problems to share network resources (printer, NAs, ...) from on subnet to another, this is another question. Don' t be affraid to create two different subnets for the VLANs. Everything will work, and your students will have access to your network ressources according to policies you set on your Fortigate.