Creating Trunk and Access Ports in Transparent Mode

[lincostinko]

All,

I'd like to share my quick guide on creating trunk and access ports in transparent mode using a single virtual domain (VDOM).  I'm a FortiOS newbie but I think this is a working solution for those that are interested.

Some key pointers:

[ul]

Transparent mode allows FW to be essentially a L2 switch (might need to enable stpforward, etc., to talk to other switches but that's beyond the scope of this article)

The functions of VLAN tagging (trunks) and VLAN traffic forwarding (trunk and access ports) are separated in FortiOS.  vlanid [number] affects how outgoing packets are tagged.  forward-domain [number] assigns ports in a broadcast domain and does the "VLAN" traffic separation we're all used to from Cisco.

To create a trunk port, you create a VLAN "interface" (for lack of a better word), add a vlanid and forward-domain for tagging and traffic separation, and assign it to a physical interface.  To add another VLAN on that trunk, you create another VLAN "interface" using the same method (different vlanid and forward-domain numbers, of course) but assign it to the SAME physical interface.

To create an access port, simply assign the same forward-domain to the desired physical interface.  The traffic will be forwarded but untagged.[/ul]

Here is an example of this on an FG-140D, with ports 1-20 on VLAN 10, ports 21-34 on VLAN 20, and ports 35-36 as a port-channel trunk:

## Configure Transparent Mode config system settings     set opmode transparent  end   ## Configure access ports for VLAN 10 config system interface edit "port1"         set vdom "root"         set type physical         set forward-domain 10     next ... (mirror the above config for the other ports, up to port20)  ## Configure access ports for VLAN 20 edit "port21"     set vdom "root"     set type physical     set forward-domain 20  ... (mirror the above config for the other ports, up to port34)  ## Configure a LAG interface edit "port35"     set vdom "root"     set type physical next edit "port36"     set vdom "root"     set type physical next edit "po1"     set vdom "root"     set type aggregate     set member "port35" "port36"     set lacp-mode active next  ## Configure trunked VLANs on LAG interface edit "vlan10_po1"     set vdom "root"     set forward-domain 10     set interface "po1"     set vlanid 10 next edit "vlan20_po1"     set vdom "root"     set forward-domain 20     set interface "po1"     set vlanid 20 end

[style="color: #222222;"] [/style]

[Kenundrum]

When I first set up one of my units in transparent mode, I was planning on doing a similar setup as yours. However, the engineer from the vendor we were using suggested a slightly different approach. In your setup, the firewall is acting as a switch. His argument was let the switch be the switch and the firewall be the firewall. So instead of creating access ports on the firewall, you set up an aggregate on the firewall that trunks all relevant VLANs and traffic goes in and out through the aggregate trunk. Servers sit on switch ports that are locked to specific VLANs and the only ports that allow all VLANs are the ones going to the firewall. The switch handles L2 separation and the firewall performs VLAN translation as traffic needs to traverse different VLANs. This allows you to not be limited by the firewall's onboard ports to connect devices and frees those ports up for other purposes such as different VDOMs or one arm sniffers, etc...

The only quirk I found when setting it up is that the transparent mode seemed to send MAC advertisements on both the VLAN tagged and untagged interfaces. So the switch would detect "port flapping" and shut it down. I had to create a blackhole VLAN on the switch and route all untagged traffic to it to prevent this from being a problem.

Either way, transparent internal segmentation does work really well for many use cases. Thanks for the write up.

[trchia]

http://kb.fortinet.com/kb/viewAttachment.do?attachID=Fortinet%20Solutions%20for%20Transparent%20Mode...