Hello folks,
I'm working on a design at the moment for small branches and I was looking at the 81E due to the port density meaning not having to use a separate switch at a small branch.
I've got a 60E for testing and what I want to do is this:
Connect one AP to the Fortigate with 4 SSID's - let's say Vlan 10, 20, 30 and 40. Each of these are sub interfaces on the physical interface that the AP is connected to.
I'd then like to create switch ports that can also access for example vlan 30 and 40 but I can't figure this out. I'd also like the ability to have multiple access points connected.
Has anyone figured this out please?
Cheers,
Steve
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
The factory configuration of the 60E has all the switch ports bridged together as a Hardware Switch interface called "Internal". If you have broken this port out from the switch as a stand-alone port you will need to undo that. All the FortiGate switch ports you intend to use need to members of the same Hardware Switch or Software Switch. Once your switch interface is created, recreate your VLANs as virtual sub-interfaces of the Switch interface. All switch ports now share the same identical untagged and tagged VLAN membership configuration, and now you can plug in multiple devices or APs into any port on that switch. PCs on the untagged VLAN can communicate with each other and devices connected to the same SSID on different APs (same tagged VLANs) can talk to each other.
The one thing you can't do with the built-in internal switch interface on a FortiGate is change the tagging and VLAN membership per port, e.g. this is NOT a supported configuration if port 1 and 2 are members of the same switch:
[ul]To do this you will need a FortiSwitch or other external switch.
Russ
NSE7
yep execept from that you don't need to undo this. You can always create a new Switch on the FGT and add Ports to it. Just the Port to add must not have any references (and as I recently found out again even an existing ip config on that port is counted as reference here).
This is the only way to do that because on a FGT vlans are threated as virtual interfaces that are tied to a physical interface (in the case Russ mentioned - the switch on the FGT). Also Vlan Interface on a FGT always equals to this interface untagged in the vlan.
You cannot divide that up this way.
You only could create annother port with annother IP Config and allow it to access one vlan by some policy.
--
"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1688 | |
1087 | |
752 | |
446 | |
227 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.