VLANs and Firewall Policies

[imani89]

A couple of questions regarding VLANs and the necessary policies to reach other VLANs and the internet.

Scenario: I have a couple of ports on our FortiGate set up as a hardware switch (LAN). I have a single static route set up (0.0.0.0/0 to ISP) and I have policies that allow the LAN to communicate with the WAN port and vice versa. We have internet / no issues. I have just added a couple of VLAN interfaces under the hardware switch. Devices on new VLANs (set with DHCP Relay) are pulling DHCP addresses from appropriate pools/appropriate server.

1. What policies do I need to reach the internet from a VLAN? Do I need policies for the VLAN and WAN to communicate, or do I just create policies for the VLAN and LAN to communicate?

2. Same question for VLAN-to-VLAN communication. Let's say that I have a VLAN for printers and a VLAN for a subset of users. Do I create policies between those 2 VLANs, or do I just create policies that allow those individual VLANs to communicate with the LAN?

[imani89]

So question 1 is resolved. I viewed the documentation and in an example for VLAN configuration you are told to create policies for the VLANs to reach the internet. So I created 2 policies: VLAN to WAN and WAN to VLAN. We have internet.

Virtual VLAN switch | FortiGate / FortiOS 7.2.4 (fortinet.com)

[Toshi_Esumi · Accepted solution]

For policies there is no difference between the parent hardswitch interfaces and those VLANs or even physical interfaces like DMZ some models have or X1/X2 for TenGig interfaces, and so on.

Until you create a policy between them, there is no traffic flowing between them. So yes, you have to create policies between any pairs of interfaces including VLANs if you want them to be able to communicate.

However, toward the internet interface, you generally want to allow only in-to-out traffic, called specifically as "sessions" that includs the initiating direction, with NAT. And you don't want to allow out-to-in traffic/sessions unless you have servers inside that are to serve users on the internet. Only in that case, you would need to create internet-to-inside interface policy with VIP(s)/DNAT(s).

By the way, that particular document you found was specifically for Virtual VLAN switch interfaces, which is slightly different from hardswitch interface you were talking about. The concept of policy above won't change between them though.

Toshi

[imani89]

This is a very helpful response, @Toshi_Esumi . Thank you.

I did have NAT setup for outbound traffic. That much I got right. I assumed that you had to have a policy that allowed traffic back in (to establish and maintain sessions), but it makes sense that this would only be necessary if people were connecting to internal servers. Since we do not have servers that people need to access, I have removed the policy that would have allowed out-to-in traffic.

VLAN in question can access the internet with the single policy.

Regarding printing, I realized that devices in most of the VLANs are domain-joined, so I don't need policies that allow traffic from those VLANs to the printer VLAN. Those devices only need access to the print server. I have a policy that allows the print server to access the printer VLAN, but not the other way around. Printers have a policy to allow internet access since we scan documents to email addresses.