Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
luisalonsoramos
New Contributor

Single-device subnets from DHCP

Hello,

 

I have a Fortigate unit where I have multiple VLANs (infrastructure, staff, guest, voice, servers...) and policies set up between them.

 

All user devices (either wired or wireless) go to the Staff VLAN, and they get a DHCP assigned address. What I want to do is to give them an IP and a limited subnet address so that they won't see other devices on the same VLAN/DHCP pool. I've seen this in public WiFis (such as hotels).

 

I tried looking in forums and Google, but I don't even know how this is called. Does anyone here know how to do this?

Thanks and happy holidays!

Luis


--
Luis Alonso Ramos
TDC Servicios, S. A. de C. V.
Chihuahua, Mexico
www.tdcservicios.com
--Luis Alonso RamosTDC Servicios, S. A. de C. V.Chihuahua, Mexicowww.tdcservicios.com
1 Solution
ebilcari

This type of filtering you are asking it will be done on Layer2 level, so users are in the same Broadcast domain/subnet and they don't need a Layer3 device (FGT) to communicate to each other, switch make this possible by default configuration.
If you have a FortiSW managed by FortiGate yes you can apply it access/private VLAN and it will change the default behavior of the Switch.

In your setup FGT + 3rd party switch you have to make changes on the switch only because as explained early the communication is done without including the Gateway.

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.

View solution in original post

8 REPLIES 8
ebilcari
Staff
Staff

Depending on your deployment,
If it includes FortiSW, the feature is called "switch-controller access VLANs": https://docs.fortinet.com/document/fortiswitch/6.4.2/devices-managed-by-fortios/985221/fortiswitch-f....

or you can find it as Private VLAN: https://docs.fortinet.com/document/fortiswitch/7.2.3/administration-guide/104079/private-vlans

For SSID there is the option: Block intra-SSID traffic

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
luisalonsoramos

Thanks for your reply. So "Private VLAN" is how they are called.

I have a Fortigate 60F with a Cisco SG350 switch. I am reading that private VLANs are a switch feature more than a router feature, so is this something I should be looking for in the switch?

 

Thanks,

 

Luis


--
Luis Alonso Ramos
TDC Servicios, S. A. de C. V.
Chihuahua, Mexico
www.tdcservicios.com
--Luis Alonso RamosTDC Servicios, S. A. de C. V.Chihuahua, Mexicowww.tdcservicios.com
ebilcari

This type of filtering you are asking it will be done on Layer2 level, so users are in the same Broadcast domain/subnet and they don't need a Layer3 device (FGT) to communicate to each other, switch make this possible by default configuration.
If you have a FortiSW managed by FortiGate yes you can apply it access/private VLAN and it will change the default behavior of the Switch.

In your setup FGT + 3rd party switch you have to make changes on the switch only because as explained early the communication is done without including the Gateway.

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
luisalonsoramos

Perfect, thank you very much. This definitely helps.

 

Thanks and happy new year!

 

Luis


--
Luis Alonso Ramos
TDC Servicios, S. A. de C. V.
Chihuahua, Mexico
www.tdcservicios.com
--Luis Alonso RamosTDC Servicios, S. A. de C. V.Chihuahua, Mexicowww.tdcservicios.com
ebilcari

You're welcome, Happy new year to you too!

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
abarushka
Staff
Staff

Hello Luis,

 

You may consider to use private VLANs. Please find the details by following the link below:

https://docs.fortinet.com/document/fortiswitch/7.2.3/administration-guide/104079/private-vlans

FortiGate
npariyar
Staff
Staff

Hi Luis,

 

I understand that you want to configure /32 subnets on Ethernet via DHCP.

 

I have tested the configuration on my Fortigate Lab and it is currently not supported.

 

Here are the screenshots attached with the error I get at GUI and CLI.

dhcp-32.png

 

Screenshot from FortiGate CLI:

dhcp-32-2.png

Niroj Pariyar
luisalonsoramos

It's not exactly a /32 or /31 subnet. Well, it is but it should be different for each device. The Private VLAN comment above is what I was looking for. I just need to find out how to do it on my switch.

 

Thanks,

 

Luis


--
Luis Alonso Ramos
TDC Servicios, S. A. de C. V.
Chihuahua, Mexico
www.tdcservicios.com
--Luis Alonso RamosTDC Servicios, S. A. de C. V.Chihuahua, Mexicowww.tdcservicios.com
Top Kudoed Authors