Transparent mode with VDOM and VLANs

[#1]

Hello, I am experiencing issues with a Fortinet in transparent mode. I have the following configuration : Firewall Nokia ---- VLAN 1 ---- Fortinet Transparent mode --- VLAN 2 --- ...... The Fortinet has a port1 connected to VLAN1 of the switch, and port2 connected to the VLAN2 of the switch. It is running in transparent mode between the firewall Nokia and the internal LAN. The switches are Nortel, and run 100% CPU when I plug port2 of the Fortinet to VLAN 2. I think the switch sees the same address on serveral VLAN a screws up. I have trying to add the parameter forward-domain without success : port1 forward-domain 1 port2 forward-domain 2 That prevents the switch from running 100% of CPU but then I cannot add any Firewalling rules in the Fortinet. Does someone knows exactly how to do ? Thanks,

[bergonz]

You should investigate wether the switches you are using are single forwarding database or multiple forwarding database. From what you say, I bet they are single forwarding database. If you cannot find this info in the switch manual, try to log in to the switch console and see the list of MACs it has learned with corresponding ports: if you see MACs moving between the ports connected to the FG then you have this kind of problem. It is not a Fortigate problem, it is a general problem with transparent firewalling. If this is the problem it can be solved by replacing the switches with other models the have multiple forwarding database, or by eliminating VLAN1 (like connecting the FG directly to the Nokia), rearranging things up so that the two interfaces of the FG will never see at layer2 the same switch. Hope this helps, Bergonz

[#3]

Thanks for your answer. I cannot plug directly the Fortinet as it is a cluster actually. For info, is the problem for the switch that it will see the MAC address of the Nokia both on VLAN1 and VLAN2 ? If we specify that on the switch (same MAC address on different ports) could that solve the issue ? Can the forward-domain parameter solve this also ? Thanks,

[UkWizard]

Not sure if i am missing the point here, but what is the goal here? fortinet aside, you are effectively puting an cable between two seperate vlans, if i understand you correctly, so of course the switches would go mad. When a fortinet is is transparent mode, its effectively bridging the ports that are that single VDOM. with the capabilities of controlling traffic that flows between them. or are you saying that the switch ports you are plugging into are set to trunk?

[#5]

We have only switch with different VLANS, here is the configuration : VLAN 1 : Firewall Nokia VLAN2 : empty VLAN 3 : LAN1 VLAN 4 : LAN2 .... PORT 24 : trunk port connected to a router which routes the different VLAN. I need to plug a Cluster of Fortinets in Transparent mode between the Firewall Nokia and the different LANS, so the solution should be to : - plug the Firewall Nokia into VLAN2 which is not in the trunk - plug port 1 of the cluster Fortinet into VLAN2 - plug port 2 of the cluster Fortinet into VLAN1 When we do that, the CPU of the switch runs at 100% I tried to plug a cross-over cable between VLAN1 and 2, and did not have any problem.

[UkWizard]

does all intervlan routing go via the port24 attached router? if so, move the fortinets between that and the switch perhaps. or use an additional switch/hub in between the nokia and fortinet. Do you only have the one nokia box or is a cluster as well? If you dont mind having a single point of failure, you could just but a cheapo 4/8 port switch to bridge the equipment.

[#7]

I am not sure all intervlana routing go via the port24. It is a cluster of Nokia. If I move the Cluster of Fortinets between the port24 which is a trunk and the router, I will need 2 others switches (one with the trunk port 24 and the 2 port1 of the Fortinet cluster, and one with the router, and the 2 port2 of the the fortinet cluster). Would that work ?

[UkWizard]

hmmm - this is a very sticky design wherever you put it really. couldnt catagorically say a particular method would 100% work, to many factors. if you have a spare switch knocking around (non-vlan capable preferably). like a netgear 8 port hub/switch. I would try sticking that between the nokias and the fortinets. so you have; Nokias ---- Netgear switch ------ fortinets ------- Switch Vlan1 Must i have to be honest, they isnt a great benefit of having two levels of firewalls. is there any reason to have two? many people and companies alike sometimes think two levels of firewall provide twice as much protection. they just dont. In all my years i have only seen one company do this kind of setup ( a very large newspaper company) they only done it to pacify there management and some standard that said it must be done.

[#9]

it is nice to use AV, IPS/IDS ...

[UkWizard]

why not ditch the nokias then?