Use previously created VLANs (internal interface) on new Fortiswitches connected via fortilink

[sistel_aaiicc]

Hi,

We currently have the following topology:

[Fortigate (VLANs)] - [Third party core distribution switches (VLAN capables)] - [Third party switches (VLAN capables) with VLANs assigned to ports]

And we want to change that into this one:

[Fortigate (VLANs)] - [Third party core distribution switches (VLAN capables)] - [Fortiswitches (with same Fortigate VLANs assigned to ports)]

We have managed to connect the new fortiswitches to the fortigate through a fortilink (through the third-party switches) but only if we use an exclusive interface for this on the fortigate. Our VLANs are defined within the "internal" interface and the fortilink is configured on a different interface, so our VLANs are not transmitted from the fortigate to the fortiswitches and we cannot use them to assign ports.

Can we transmit our VLANs from fortigate to fortiswitches using another connection (not-fortilink)? What would be the correct way to do that?

We think that if we'd have to transmit our VLANs through the fortilink interface, then we'd have to change every switch in the LAN nearly at the same time because third party switches will stop working if we change our VLANs to another interface than theirs. Is it correct?

Thank you very much!

[adambomb1219]

You can run the FortiSwitches in standalone mode (not FortiLink).  Or managed via FortiLAN Cloud.  In reality, you should eliminate the 3rd party core/distribution switches completely....

[sistel_aaiicc]

Hi Adam, thank you for your response.

We do run FortiSwitches in managed mode via Fortilink, that's not the problem. Our problem is to keep previously created VLANs in the network because the Fortiswitches seems to not notice those VLANs because they are asociated to the "internal" interface, not "fortilink" interface. So we want to know if there are any way to connect Fortiswitches to both interfaces (internal and fortilink) to get the management through fortilink and the VLANs through "internal". I hope I've been explained well. Thanks!

[adambomb1219]

No.  You cannot share VLANS like this across FortiLink and non-FortiLink interfaces.  You can do some layer2 hacks or a software switch to make this work but its not a good practice at all.  Why not just move all VLANs to FortiLink?  Hang third-party switches off of the downstream FortiSwitches?

[hbac]

Hi @sistel_aaiicc,

fortilink can be enabled on any physical interfaces. You can run the following commands: 

config system interface 

edit internal 

set fortilink enable 

end 

Regards, 

[sistel_aaiicc]

Hi @hbac , thank you for your response.

So, do you say that we can enable a fortilink through the "internal" interface and get the Fortiswitches management and VLANs through the same interface? We thinked that fortilink needed to be in a separate exclusive interface.

Thanks again!