firewall between lan to lan

[noiz]

Hi, how can i configure firewall between lan to lan? fortigate type : fortigate 60 version : 2.80 mr11 network : 192.168.10.0 / 255.255.255.0 my problem :- i wanted create 3 group of user and that group can' t communicate (file sharing) each other. for example :- 192.168.10.10 until 192.168.10.50 (group A) 192.168.10.51 until 192.168.10.100 (group B) 192.168.10.101 until 192.168.10.150 (group C) i want to create policy that group A cant communicate with group B and group C and want to create policy that group B cant communicate with group A and group C and want to create policy that group C cant communicate with group A and group B

[#2]

HI, I tried to do it with a fortigate 60, ios 3.0 with internal/internal firewall policies but it did not work I cant find a solution yet ... Waiting for help like you...

[rwpatterson]

That will never work. As long as the users share the same network (same port on Fortigate and same network number), they will never see the Fortigate, and they will not be filtered/blocked with the policies. The only way I could think of is to use multiple IP addresses on the interfaces, and use internal and DMZ to accomplish this. The easiest way would be to pick up a low end router.

[noiz]

is there any option in the fortigate that can solve this. a lot of thing under router and policy ihave not try yet.such ip pool...how to use it? what it use for?

[rwpatterson]

Think about it this way: If you remove the Fortigate, all the devices are now on the same network, and can see each other. The only way to stop the flow of traffic between them is to place them on different sides of a routing device, or change their network numbers so that they are in effect are speaking different languages. The only way the Fortigate can effect thier communication is if it sits between them somehow. If they plug into the same switch, you could separate them by VLAN, but by using the same subnets, they will see each other. This is assuming a class C subnet. If you used a split subnet (192.168.10.x/28), you could break them down as: 192.168.10.0/255.255.255.192 (1-62) 192.168.10.64/255.255.255.192 (65-126) 192.168.10.128/255.255.255.192 (129-190) 192.168.10.192/255.255.255.192 (193-254) They will not be able to see between the subnets, unless you make the appropriate changes on the Fortigate. I am assuming here that you will be giving each subnet the same privileges on the port, and using a straight 24 bit subnet on the port of the Fortigate, and that the Fortigate will treat the incoming addresses as such. I have never done this and I know that Crisco routers don' t do this well. It may work, or it may not. It' s just an idea that I had. Maybe someone out there has messed with split subnetting and can give more insight into this scenario. Good luck.

[noiz]

i' ll upgrade to version 3 mr3 then put 3 secondry ip address and have solve my problem already. i cant make it in same subnet. unless i did it as per your example above.but cant go to internet. so i try upgrade the firmware and found out it have new feature for secondary ip address then i put it in different ip range and done...i can control 4 ip range with 4 gateway in 1 routers.

[#7]

Noiz, I am not sure how many interfaces on your 60 model, but if they are 3 then use the Transparent Mode. I know its a late reply, but I wanted to share this with you.. Good Luck

[#8]

Just create 3 vlan' s and config it. But for arguments sake this is not a firewall problem. Regards, Eric

[noiz]

hi all, im not set ip for all of the point in the fortigate. i just enable the secondary ip for the lan interface. try upgrade to mr3 then you would know. until now it working perfect.