Vlan configuration in Transparent Mode (forward-domain)

[elljefe]

I am having some issues understanding the documentation regarding collision groups (forward-domain). Here is the sample config the Fortinet documentation lists: config system interface edit port1 next edit port2 set forward_domain 340 next edit port3 set forward_domain 341 next edit port1-340 set forward_domain 340 set interface port1 set vlanid 340 next edit port1-341 set forward_domain 341 set interface port1 set vlanid 341 end In this example, are port1-340 & port1-341 the names of NEW interfaces that are being created or is this the existing name of an already created Vlan interface? I need to move each Vlan into its own collision group and need to know the proper topology and syntax to do so. Thanks in advance for the help! BTW: I have tried entering in the commands listed above and creating a NEW interface name (separate from the existing Vlan interface name) and I get a mysterious 651 error message.

[Carl_Wallmark]

Hi, and welcome, " Forward Domains" is a way to tag traffic inside the FortiGate when using the FG as a transparent device. if you have multiple vlans in a transparent vdom, every packet entering the FG will be sent to all interfaces, making arp go crazy, so forward domain tags traffic when its entering the FG, and then pairing it with another interface with the same forward domain. You are seperating the traffic in a layer 2 vdom. Port1-340 are just a common vlan interface, the name just describes what forward domain it belongs to.

[ede_pfau]

good morning Selective, to answer the other questions of elljefe: 1.it does not matter if the VLAN already exists; if you enter

 edit port1-340 

either a new VLAN interface will be created or an existing VLAN interface will be edited. 2. regarding error 651: the correct syntax is

set forward-domain <domainID>

with a hyphen, not an underscore. This is a typo in the FortiOS Handbook, both for 4.00MR2 and 4.00MR3. Same typo is repeated with the

set netbios-forward

command. One more note: IMHO it is not mandatory to introduce forward-domains, even if using VLAN trunks. Only if you expect the same MAC address to appear on different VLANs (and/or untagged traffic) then separating VLANs into collision domains via the forward-domain command will avoid arp issues.

[elljefe]

Thanks guys for the responses, they are very helpful! Just a bit of clarification then... 1) Let' s say I have 2 physical interfaces labeled EXTERNAL and INTERNAL 2) Let' s say i have already created 4 virtual interfaces labeled VLAN0011-EXT, VLAN0011-INT, VLAN0012-EXT, VLAN0012-INT Should my config look like this? config system interface edit EXTERNAL set forward-domain 11 next edit INTERNAL set forward-domain 11 next edit VLAN0011-EXT set forward-domain 11 set interface EXTERNAL set vlanid 11 next edit VLAN0011-INT set forward-domain 11 set interface INTERNAL set vlanid 11 next edit EXTERNAL set forward-domain 12 next edit INTERNAL set forward-domain 12 next edit VLAN0012-EXT set forward-domain 12 set interface EXTERNAL set vlanid 12 end next edit VLAN0012-INT set forward-domain 12 set interface INTERNAL set vlanid 12 end Thank you for all of your help! BTW: I just realized you can only have 1 forward-domain per physical interface so my sample config above wont work. How are multiple collision groups (forward-domain) configured on physical interfaces? Or is it not necessary to set the forward-domain command on the physical interface... only necessary on the Vlan interface?

[ede_pfau]

Ports (physical or VLAN) can only belong to ONE collision domain. By default all ports of a Fortigate belong to domain " 0" . If you want to / have to isolate VLAN broadcast domains from each other (e.g. because you use identical MAC addresses on different VLANs) then you assign each port to one forward domain. My advice: - check thoroughly if you need forward domains at all - if so, assign the ingress and egress ports of each of your VLANs to an associated forward domain. Leave the physical ports out.

[elljefe]

Thanks for the responses. I added the forward-domain command and still seem to be having the same problem. Here is my config: FW02 (interface) # show config system interface edit " internal" set vdom " root" set allowaccess ping https set type physical set speed 100full next edit " external" set vdom " root" set allowaccess ping https set type physical set speed 100full next edit " dmz" set vdom " root" set allowaccess ping https set type physical next edit " VLAN0011-EXT" set vdom " root" set allowaccess ping https ssh set forward-domain 11 set interface " external" set vlanid 11 next edit " VLAN0011-INT" set vdom " root" set allowaccess ping https set forward-domain 11 set interface " internal" set vlanid 11 next edit " VLAN0012-EXT" set vdom " root" set allowaccess ping https set forward-domain 12 set interface " external" set vlanid 12 next edit " VLAN0012-INT" set vdom " root" set allowaccess ping https set forward-domain 12 set interface " internal" set vlanid 12 next edit " VLAN0009-EXT" set vdom " root" set allowaccess ping https set forward-domain 9 set interface " external" set vlanid 9 next edit " VLAN0009-INT" set vdom " root" set allowaccess ping https set forward-domain 9 set interface " internal" set vlanid 9 next edit " VLAN0234-EXT" set vdom " root" set allowaccess ping https set forward-domain 234 set interface " external" set vlanid 234 next edit " VLAN0234-INT" set vdom " root" set allowaccess ping https set forward-domain 234 set interface " internal" set vlanid 234 next edit " VLAN0164-EXT" set vdom " root" set allowaccess ping https set forward-domain 164 set interface " external" set vlanid 164 next edit " VLAN0164-INT" set vdom " root" set allowaccess ping https set forward-domain 164 set interface " internal" set vlanid 164 next edit " VLAN0377-EXT" set vdom " root" set allowaccess ping https set forward-domain 377 set interface " external" set vlanid 377 next edit " VLAN0377-INT" set vdom " root" set allowaccess ping https set forward-domain 377 set interface " internal" set vlanid 377 next edit " VLAN0527-EXT" set vdom " root" set allowaccess ping https set forward-domain 527 set interface " external" set vlanid 527 next edit " VLAN0527-INT" set vdom " root" set allowaccess ping https set forward-domain 527 set interface " internal" set vlanid 527 next end Here is the topology of this segment of the network: Cisco 3548XL | (trunk) Fortigate 200 | (trunk) Cisco 2924XL-EN #1 | (trunk) | (trunk) Cisco 2924XL-EN #2 [Cisco 2924XL-EN #3] This setup works fine with switch #2 trunked down from switch #1. However, when I add a 2nd switch [Cisco 2924XL-EN #3] the entire network goes haywire and everything becomes inaccessible. Any ideas? Thanks!

[emnoc]

Going haywire could be a host of things. things to review How are propagation sanning-tree and vlan information? are the trunks properly configured? what switch in the series of switches are RootBridge? etc... You need to identify the issue to the appropiate layer and it' s most likely is not the fgt in this issue.