Trunks and access ports?

[Zimmie]

Several people convinced me that the next platform I should learn is Fortinet's, so I just got a used FortiGate 90D. Amusingly enough, it still has support and contracts for a few more weeks, so I updated it to 5.4, build 1011. I can't seem to find a way to set up a VLAN that is tagged on one physical interface and untagged on another. On JunOS, I would do this:

set interfaces ge-0/0/0 unit 0 family ethernet-switching port-mode trunk set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members userVlan

set interfaces ge-0/0/1 unit 0 family ethernet-switching port-mode access

set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan userVlan

set interfaces vlan unit 10 family inet address 192.168.10.1/24

set vlans userVlan vlan-id 10 set vlans userVlan l3-interface vlan.10

That would tag the VLAN out port 0/0/0, not tag it out port 0/0/1, and the router would have a layer 3 interface on the VLAN that can be reached from either to act as the gateway for all traffic on that VLAN.

I don't see a way to do anything similar on my FortiGate. It looks like VLANs are always subordinate to a physical port. Is there a way to bridge a tagged VLAN on one physical port with untagged traffic on another physical port and have only one IP on the FortiGate to represent that combined interface? If not, it seems silly to have such a huge number of ports on the boxes.

[Toshi_Esumi · Accepted solution]

If you search you would find many other thread discussing about vlans on FortiGate. Below is the latest conversation:

https://forum.fortinet.com/tm.aspx?tree=true&m=134559&mpage=1

In my understanding, you still can't even with 5.4.

[Zimmie]

Okay. I had run across a few threads like that, but wasn't sure if I was just reading them wrong, or what. So it sounds like it's best to think of the FortiGates as servers with a bunch of interfaces rather than switches that do security stuff. I'm sort-of accustomed to this, as I manage Check Point boxes at my day job. Still, it seems odd to me to have so many ports if it can only either treat them as distinct interfaces or do really basic switching. I guess it's better to have too many ports and not use a bunch than to have too few and need another piece of hardware.

It's a very interesting platform otherwise. I look forward to learning more!