Using spare ports on Fortigate as switchports

[Karar]

Hello folks,

I'm working on a design at the moment for small branches and I was looking at the 81E due to the port density meaning not having to use a separate switch at a small branch.

I've got a 60E for testing and what I want to do is this:

Connect one AP to the Fortigate with 4 SSID's - let's say Vlan 10, 20, 30 and 40. Each of these are sub interfaces on the physical interface that the AP is connected to.

I'd then like to create switch ports that can also access for example vlan 30 and 40 but I can't figure this out. I'd also like the ability to have multiple access points connected.

Has anyone figured this out please?

Cheers,

Steve 

[TecnetRuss]

The factory configuration of the 60E has all the switch ports bridged together as a Hardware Switch interface called "Internal".  If you have broken this port out from the switch as a stand-alone port you will need to undo that.  All the FortiGate switch ports you intend to use need to members of the same Hardware Switch or Software Switch.  Once your switch interface is created, recreate your VLANs as virtual sub-interfaces of the Switch interface.  All switch ports now share the same identical untagged and tagged VLAN membership configuration, and now you can plug in multiple devices or APs into any port on that switch. PCs on the untagged VLAN can communicate with each other and devices connected to the same SSID on different APs (same tagged VLANs) can talk to each other.

The one thing you can't do with the built-in internal switch interface on a FortiGate is change the tagging and VLAN membership per port, e.g. this is NOT a supported configuration if port 1 and 2 are members of the same switch:

[ul]

port 1 = VLAN 1 untagged, VLAN 10, 20, 30, 40 tagged

port 2 = VLAN 30 untagged[/ul]

To do this you will need a FortiSwitch or other external switch.

Russ

NSE7

[sw2090]

yep execept from that you don't need to undo this. You can always create a new Switch on the FGT and add Ports to it. Just the Port to add must not have any references (and as I recently found out again even an existing ip config on that port is counted as reference here).

This is the only way to do that because on a FGT vlans are threated as virtual interfaces that are tied to a physical interface (in the case Russ mentioned - the switch on the FGT). Also Vlan Interface on a FGT always equals to this interface untagged in the vlan.

You cannot divide that up this way.

You only could create annother port with annother IP Config and allow it to access one vlan by some policy.