Transparent mode segementation

[aluminex]

Is it possible to run a Fortinet firewall in transparent mode, but still provide segmentation for multiple internal networks?

For instance:

WAN1 ---> Connected to Internet

PORT1 ---> 172.18.5.x network

PORT2 ---> 172.19.5.x network

PORT3 ---> 172.20.5.x network

Based on my understanding running in transparent mode basically converts the firewall into a forwarding bridge which would make 172.18.5/172.19.5/172.20.5 on the same layer2 network and provide no segmentation.  Would VLANS or multiple VDOMS provide the segmentation desired?

[doshbass]

You can split pair of interfaces into forwarding domains.  This means that if you have two interfaces in a forwarding domain

config system interface

   edit xxxx

   set forwarding domain xxx

  end

traffic will only pass between those two interfaces, effectively separating the transparent mode into multiple separate L2 domains.

I think however what you are trying to do is to have all internal interfaces only able to talk to the Internet interface.

But if you have separate L3 networks on each of those internal interfaces then transparent mode is probably not right for you.

Where is the default gateway for each of those internal subnets?  If it is on a router on the Internet side then I would expect some form of VLANs on the router.  If this is the case, then you can create 802.1q VLANs on the Internet link.  These VLANs then appear as Interfaces and can be configured to be in a broadcast domain.

But overall, it looks like you probably want NAT/route mode over transparent.