vlan on multiple interfaces without IP

[vanawful]

I have an environment in which industrial switches (not fortiswitch) needs to be on the same mgmt vlan for all subnets. I am not finding a way to have the mgmt vlan passthrough on a foritgate with v7.6.x while also having the interfaces for the OT subnets.

Confused? Here is an example:

- Port WAN1: vlan 200 interface (main OT network), tag vlan1000 (mgmt) without creating interface

- Port 1: Contains vlan 801 interface

- Port 2: Contains vlan 802 interface

- Port 3: Contains vlan 803 interface

VLAN1000 must be tagged on Ports WAN1, 1, 2, and 3, without interface (passthrough). This is used to manage the managed switches.

This can be done on industrial firewalls from Siemens and Hirschmann. How is it done with Fortigate?

[Jean-Philippe_P]

Hello vanawful, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

[AEK]

The only way I know is to create VLAN interface id 1000 on the related ports.

[ebrlima]

FortiGate only performs vlan tagging if you create the interface vlan. One thing you can do is having an EMAC VLAN with the 1000 tag over each physical port. Like this:

SPOKE # show sys interface | grep "vlanid 1000" -f
config system interface
edit "V1000-P3"
set vdom "root"
set type emac-vlan
set role lan
set snmp-index 17
set ip-managed-by-fortiipam disable
set interface "port3"<---
set vlanid 1000 <---
next
edit "V1000-P4"
set vdom "root"
set allowaccess ping
set type emac-vlan
set role lan
set snmp-index 18
set ip-managed-by-fortiipam disable
set interface "port4" <---
set vlanid 1000 <---
next
end

SPOKE # fnsysctl ifconfig V1000-P3
V1000-P3 Link encap:Ethernet HWaddr 06:0C:29:FF:89:D9
link-local6: fe80::40c:29ff:feff:89d9 prefixlen 64
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:7 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0 Bytes) TX bytes:746 (746 Bytes)

SPOKE # fnsysctl ifconfig port3
port3 Link encap:Ethernet HWaddr 00:0C:29:FF:89:D9
link-local6: fe80::20c:29ff:feff:89d9 prefixlen 64
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:497098 errors:0 dropped:0 overruns:0 frame:0
TX packets:14 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:35208840 (33.6 MB) TX bytes:1520 (1.5 KB)

SPOKE # fnsysctl ifconfig port4
port4 Link encap:Ethernet HWaddr 00:0C:29:FF:89:E3
link-local6: fe80::20c:29ff:feff:89e3 prefixlen 64
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:497099 errors:0 dropped:0 overruns:0 frame:0
TX packets:16 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:35208487 (33.6 MB) TX bytes:1708 (1.7 KB)

SPOKE # fnsysctl ifconfig V1000-P4
V1000-P4 Link encap:Ethernet HWaddr 06:0C:29:FF:89:E3
link-local6: fe80::40c:29ff:feff:89e3 prefixlen 64
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:7 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0 Bytes) TX bytes:746 (746 Bytes)

You can learn more about emac vlans on Fortigate here:

https://docs.fortinet.com/document/fortigate/7.6.3/administration-guide/212317/enhanced-mac-vlan

[sjoshi]

you have mentioned that you have tagged vlan 1000 in wan1 without creating interface. Can you elaborate more how you have done it?

Are you using native vlan?