VXLAN layer 2 trunk ?

[douglas1942]

Hello, I am wanting a layer 2 trunk (supporting 5 VLANs) across a dialup IPSEC tunnel.

I will have two Fortigate 60Es on each end for the L3 IPSEC tunnel, then will use VXLAN for the layer 2 trunking.

In theory this should be possible with FortiOS, correct ?

Thank you.

[akristof · Accepted solution]

Hello,

Yes. It is possible. For each vlan you want to extend you would need to vxlan interface with unique vni and bridge vlan and vxlan together in software switch. This will allow you to use 1 Ipsec tunnel but extend multiple vlans over it. Something like this:

https://community.fortinet.com/t5/FortiGate/Technical-Note-Virtual-Extensible-LAN-VXLAN-configuratio...

It is not your scenario but this is example config. But this kb is for native vxlan, not vxlan over Ipsec, so main difference in your case would be that the vxlan would be bounded to ipsec interface.