Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
fl0at0xff
New Contributor II

Basic question about VLAN design

Hello,

 

I just have a basic question: When you configure a Fortigate, what is the best practice regarding the configuration of VLAN ? For example, imagine I have 5 different VLAN in my network, I want to make the inter-vlan routing with the fortigate, how can I configure the interfaces ?

- It is better to create 5 vlan-interface under only one physical interface

- It is better to create 5 vlan-interface under 5 physical interfaces (one per vlan)

- It is better to use 5 physical interfaces as access interfaces ?

 

Thank you for you answers

7 REPLIES 7
Somashekara_Hanumant

Hello,

 

- It is better to create 5 vlan-interface under only one physical interface

>>> Yes you can configure 5 VLAN interfaces on only one physical interface

 

- It is better to create 5 vlan-interface under 5 physical interfaces (one per vlan)

>>> You can configure each VLAN on different physical interfaces, advantage of multiple VLAN's on multiple interfaces is bandwidth

- It is better to use 5 physical interfaces as access interfaces ?

>>> This option also similar to the above option, you will be dividing the bandwidth on 5 interfaces,

 

Please refer the below documents also.

 

http://help.fortinet.com/...%20in%20NAT%20mode.htm

 

https://www.youtube.com/watch?v=NVLDRHLWbWc

 

Cheers

Somu

EMEA Technical Support
fl0at0xff

Hello and thank you for your answer.

 

Ok for the bandwidth argument. I understand the added-value tu use separate interface.

Now, when is it preferable to create one VLAN sub-interface per physical interface and when use directly the physical interface. Does it depend only of the configuration of the switch on the other side ? 

Nils

I would prefer to use Link Aggregation.

Aggregate several physical interfaces and then create vlan interfaces under the logical bundle.

But this is only supported on series above 100D(?).

 

Otherwise I would say that if you think you'll create new networks in the future, its better to go with VLAN intefaces. Then it's easy to just add a vlan to that interface and configure an IP-address without having physical access to the firewall.

 

fl0at0xff
New Contributor II

Hello Nilsan and thank you for this answer ! Your solution looks great and interessting in terms of available bandwitdh. But how do you handle /configure LACP ? I think, I will prefer the solution with vlan interface for reason of scalabilty. For example, if a I have a 60D with 7 ethernet ports and I need to create 7 vlan, I will use a vlan interface per physical port and with this solution, if in the future I need to add a new vlan, I can simply add a new vlan interface ... I think it could be a good reflexion 

rwpatterson
Valued Contributor III

fl0at0xff wrote:

Hello Nilsan and thank you for this answer ! Your solution looks great and interessting in terms of available bandwitdh. But how do you handle /configure LACP ? I think, I will prefer the solution with vlan interface for reason of scalabilty. For example, if a I have a 60D with 7 ethernet ports and I need to create 7 vlan, I will use a vlan interface per physical port and with this solution, if in the future I need to add a new vlan, I can simply add a new vlan interface ... I think it could be a good reflexion 

I think you are confusing link aggregation with VLANs. The series below 100d(?) cannot share data between ports (LACP), but yes you can put multiple VLANs on a singe interface (802.1q tagging).

 

Hope that helps

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
fl0at0xff

Hello and thank you for your answers ! I have a better idea how to configure/handle VLANs on Fortigate regarding the needs and possibilities of my clients.

 

Thank

MikePruett

Yeah, if you are going to have a bunch of traffic flowing (more than the port you are building the VLAN's onto will support) then bundle those things up and enjoy the aggregated bandwidth benefit.

Mike Pruett Fortinet GURU | Fortinet Training Videos
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors