VLAN Interface

[YHC]

Hi,

I have a FortiGate 30E and connect to a D-Link GS1900 Switch on Port 4 of FortiGate.

The default subnet is "lan"(192.168.0.x).

I have created two VLANs(192.168.2.x and 192.168.3.x) and both works now (seel below screen shots).

I would like to know:

1. Interface: For both VLANs, I can choose "lan" or "wan"(connect to the WAN physical port) as the interface.  Can anyone advice me the differences of choosing "lan" or "wan" as interface?

2. Any additional routing(static or policy) is required to make sure the two VLANs can go to internet?

Thank you.

[Toshi_Esumi]

The wan must be connected to your ISP modem/router, or the cable from the ISP might be terminated at the wan port. If you put a VLAN on wan interface, that's not going to your switch and only your ISP's modem/router or their GW can see it.

Obviously you have to put those two VLANs on the lan interface since your switch is connected to one of hardswitch member member port: lan4.

Toshi

[Toshi_Esumi · Accepted solution]

For Q2, routing shouldn't be issue since both would follow the default route to the internet. However, you have to have policies for both VLAN interfaces to get out through wan interface.

You could put both VLANs into one zone and have just one policy from the zone to wan interface. But to do that, you have to remove all existing policies referring to each VLAN interface first.

Once you start using a zone, you can't use individual VLAN interfaces for policies.

Toshi

[YHC]

Hi Toshi,

Thanks for the reply.

Do you mean i should add a policy that allow traffic from WAN to my zone/VLAN?

Once I star to use a zone, can I still prohibit inter-VLAN traffic? 

[Toshi_Esumi]

That's depending one if one of/some of your devices in VLANs need to be accessed from the internet. In that case you need to have VIP(s) to change/swap the destination IP from wan's public IP to the local server IP. You should enable only specific TCP/UDP ports for the VIP/DNAT.

Toshi

[Toshi_Esumi]

When you create a zone, you have an option to enable/disable intra-zone traffic. But if you allow outside-to-inside VIPs for one of (server?) VLANs, I don't recommend put them together into one zone. You should have them separated and control traffic between them or out-to-in per VLAN with policies.

[JackieDouglas]

Thank you, I will try it. I appreciate you for answering.