Single-device subnets from DHCP

[luisalonsoramos]

Hello,

I have a Fortigate unit where I have multiple VLANs (infrastructure, staff, guest, voice, servers...) and policies set up between them.

All user devices (either wired or wireless) go to the Staff VLAN, and they get a DHCP assigned address. What I want to do is to give them an IP and a limited subnet address so that they won't see other devices on the same VLAN/DHCP pool. I've seen this in public WiFis (such as hotels).

I tried looking in forums and Google, but I don't even know how this is called. Does anyone here know how to do this?

Thanks and happy holidays!

Luis

[ebilcari]

Depending on your deployment,
If it includes FortiSW, the feature is called "switch-controller access VLANs": https://docs.fortinet.com/document/fortiswitch/6.4.2/devices-managed-by-fortios/985221/fortiswitch-f....

or you can find it as Private VLAN: https://docs.fortinet.com/document/fortiswitch/7.2.3/administration-guide/104079/private-vlans

For SSID there is the option: Block intra-SSID traffic

[luisalonsoramos]

Thanks for your reply. So "Private VLAN" is how they are called.

I have a Fortigate 60F with a Cisco SG350 switch. I am reading that private VLANs are a switch feature more than a router feature, so is this something I should be looking for in the switch?

Thanks,

Luis

[ebilcari · Accepted solution]

This type of filtering you are asking it will be done on Layer2 level, so users are in the same Broadcast domain/subnet and they don't need a Layer3 device (FGT) to communicate to each other, switch make this possible by default configuration.
If you have a FortiSW managed by FortiGate yes you can apply it access/private VLAN and it will change the default behavior of the Switch.

In your setup FGT + 3rd party switch you have to make changes on the switch only because as explained early the communication is done without including the Gateway.

[luisalonsoramos]

Perfect, thank you very much. This definitely helps.

Thanks and happy new year!

Luis

[ebilcari]

You're welcome, Happy new year to you too!

[abarushka]

Hello Luis,

You may consider to use private VLANs. Please find the details by following the link below:

https://docs.fortinet.com/document/fortiswitch/7.2.3/administration-guide/104079/private-vlans

[npariyar]

Hi Luis,

I understand that you want to configure /32 subnets on Ethernet via DHCP.

I have tested the configuration on my Fortigate Lab and it is currently not supported.

Here are the screenshots attached with the error I get at GUI and CLI.

Screenshot from FortiGate CLI:

[luisalonsoramos]

It's not exactly a /32 or /31 subnet. Well, it is but it should be different for each device. The Private VLAN comment above is what I was looking for. I just need to find out how to do it on my switch.

Thanks,

Luis