internal routing multiple subnets 1 physical port

[jbrowne]

In the past, I setup a FG100D with multiple internal subnets by using multiple physical ports on the Fortigate and assigning the IPs to those ports as gateways, so each internal subnet could talk to each other.

I'm setting up a FG100D at a different company with similar needs.  I was trying to make it simpler by using a single physical LAN port on the Fortigate - possible ?

subnets=  192.168.1.0 ,  192.168.8.0 , 192.168.37.0 , 192.168.41.0   

each having a gateway of .x.250  (192.168.1.250....etc....)

These should each have access to the other.

And these should each have access to the WAN port.

Must I use multiple LAN ports ?

thanks.

[Silver]

Hello,

Yes this can be achieved by using sub interface. 

Thanks

[Dave_Hall]

If the company's network is segmented by department, you may be better off using vlans on the physical LAN port, assuming you are able to implement/configure vlans on the network switches and/or devices directly. 

If the company is small and/or does not see a lot of network traffic, you could just create a class B or classless subnet at the private level (eg. 10.10.x.x or 192.168.x.x).

If you need to have multiple subsets on a physical interface, you could create/bind secondary IPs to an interface and use hairpin policies to route traffic.  See KB FD30118.  See also FD30014 regarding overlapping subnets.

Personally, I would use vlans if possible or multiple physical ports.

[jbrowne]

@Silver - thanks for suggestion.

@Dave Hall  - I tried the secondary IPs (KB FD30118) - but it didn't seem to work.

I'm trying to make the Fortigate's setup as simple as possible with as few steps.

I was also looking at https://cookbook.fortinet.com/using-zones-to-simplify-firewall-policies-56/

but haven't finished the steps yet.

[Dave_Hall]

The hairpining scenario (KB FD30118) should work providing those secondary IPs (binded to the primary interface) show up in the routing table, attached to the same Interface and you have created the hairpin policy(ies).

The cookbook recipe you are referring to, is built on having vlans setup on your switch(es) - is this the case?

[jbrowne]

I've been playing with it all day today. different scenarios / setups.

I'm trying to stay away from vlans.

currently (working)  I'm back to using multiple physical interfaces with an IP/subnet assigned per interface.  All physical interfaces plugged into the same switch.  And, I'm using a Zone on the Fortigate with all these physical interfaces in one Zone.

[lobstercreed]

@jbrowne, coming late to this thread, I am curious why you are trying to stay away from VLANs?  They're the best!  :)  Unless of course your switch hardware is unmanaged or something...

We use our FortiGate to chop up our network every which way, using zones to group like policies together but we still have about 2 dozen VLANs on 3 physical interfaces.

[kingpin]

i have the same issue. my previous network is using mikrotik router. working in one interface all the subnet i have 16 subnet. then i want to configured also my fortinet as the same with mikrotik because we dont have any tagged in lan cable i dont know where's the cable connected in switch. my switch is not manageable that why i cannot config thru vlan. any suggestion guys thanks in advane  

[sw2090]

well...it should work with seconday ip. Just you have to give the FGT interface an ip and not a subnet. You don't need a gateway on the fortigate as you then have an interface in that subnet. So FGT will kow where to route it.

What you do need is some policies to allow traffic between subnets or between subnets and internet.

This is the most easy way to this but will take you certain options away since there is only one interface then.

E.g. you cannot enable DNS Forwarding oder DHCP for a certain subnet in this setup.

[jbrowne]

@Silver - thanks for suggestion.

@Dave Hall  - I tried the secondary IPs (KB FD30118) - but it didn't seem to work.

of course, I'm not an expert on IP addressing or routing.

all the end points have class C netmasks and single IPs.

I'm trying to make the Fortigate's setup as simple as possible with as few steps.

I was also looking at https://cookbook.fortinet.com/using-zones-to-simplify-firewall-policies-56/

but haven't finished the steps yet.