Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
aluminex
New Contributor

Transparent mode segementation

Is it possible to run a Fortinet firewall in transparent mode, but still provide segmentation for multiple internal networks?

 

For instance:

WAN1 ---> Connected to Internet

PORT1 ---> 172.18.5.x network

PORT2 ---> 172.19.5.x network

PORT3 ---> 172.20.5.x network

 

Based on my understanding running in transparent mode basically converts the firewall into a forwarding bridge which would make 172.18.5/172.19.5/172.20.5 on the same layer2 network and provide no segmentation.  Would VLANS or multiple VDOMS provide the segmentation desired?

 

1 REPLY 1
doshbass
New Contributor III

You can split pair of interfaces into forwarding domains.  This means that if you have two interfaces in a forwarding domain

 

config system interface

   edit xxxx

   set forwarding domain xxx

  end

 

traffic will only pass between those two interfaces, effectively separating the transparent mode into multiple separate L2 domains.

 

I think however what you are trying to do is to have all internal interfaces only able to talk to the Internet interface.

 

But if you have separate L3 networks on each of those internal interfaces then transparent mode is probably not right for you.

 

Where is the default gateway for each of those internal subnets?  If it is on a router on the Internet side then I would expect some form of VLANs on the router.  If this is the case, then you can create 802.1q VLANs on the Internet link.  These VLANs then appear as Interfaces and can be configured to be in a broadcast domain.

 

But overall, it looks like you probably want NAT/route mode over transparent.

Still learning to type " the"
Still learning to type " the"
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors