Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
ben
New Contributor

Combine PoE and internal interfaces on Fortigate60D POE

I am new to Fortigate firewall management.

There is a lot to like about the 60DPoE but one thing I don't is Joining the 2 PoE interfaces to the internal switch.

What's the best way to combine the 2 PoE (InternalA, InternalB) and Internal (5 port switch).

I bought the 60D PoE because it had not only a configurable firewall but 2 PoE ports which would allow me to remove a Linksys PoE switch needed for 2 IP cameras.

The NVR is of course on the 5 port internal switch interface but the 2 PoE ports are required to be on different subnets.

The system works fine as long as I continue to run the IP cameras on a separate PoE switch using the internal 5 ports (all on the same subnet), but I need to get the 2 internalA internalB PoE ports mapped into the same subnet as the NVR. It seems like Fortinet would have an easy way to merge these interfaces. The 60D is basically configured to the factory default settings.

Ben

 

 

14 REPLIES 14
Dave_Hall
Honored Contributor

Not familiar with the 60D POE, but I assume you could still create a soft switch.  Just make sure there are no references to the ports you want to create the soft switch.  If the fgt has a clean/factory installed (e.g. exec factoryreset from CLI) you only need to delete the firewall policy for internal to "WAN", disable the DHCP on the internal.  Then you should be able to create the soft switch from that point.

 

 

Alternately, if a soft switch is not doable, you may need to resort to setting up one or two VIPs then create a firewall policy (or two) between the internal and POE ports with NAT enabled. [strike](Kinda ugly imho.)[/strike]

 

Edit: Actually just creating two firewall polices between internal and the two poe ports with NAT enabled would also work. 

 

 

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
ben
New Contributor

Reading the Fortinet VIP documentation it sounds like they discourage VIP use in this way:

http://docs-legacy.fortin...lp/objects.067.08.html

----------------------------------------

  Virtual IP addresses are typically used to NAT external or Public IP addresses to internal or Private IP addresses. [style="background-color: #ffff00;"]Using a Virtual IP address between 2 internal Interfaces made up of Private IP addresses is possible but there is rarely a reason to do so as the 2 networks can just use the IP addresses of the networks.[/style]

 

Dave_Hall
Honored Contributor

ben wrote:

Reading the Fortinet VIP documentation it sounds like they discourage VIP use in this way:

http://docs-legacy.fortin...lp/objects.067.08.html

----------------------------------------

  Virtual IP addresses are typically used to NAT external or Public IP addresses to internal or Private IP addresses. [style="background-color: #ffff00;"]Using a Virtual IP address between 2 internal Interfaces made up of Private IP addresses is possible but there is rarely a reason to do so as the 2 networks can just use the IP addresses of the networks.[/style]

Which is why edited my post to just using "natted" firewall policies if you can't use a soft switch.

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
dwdino

Still looking for a solution to this. Any updates?

Toshi_Esumi
Esteemed Contributor III

I tested with FWF60D-POE w/ 5.4.3. But I could make internalA as a member of the default soft switch (config sys switch-interface in CLI) interface "lan". I believe FG60D-OPE would behave the same. In case FWF, the default "lan" interface includes both "internal" hard switch (virtual-switch) interface and "wifi" vap-switch(SSID) interface. I just let internalA to join them.

dwdino

Toshi,

 

When I try that, the system responds "entry not found in datasource".

dwdino
New Contributor

Found the solution in 5.4.3.

 

By default the internalA and internalB (POE Interfaces) are given their own unique IP (169.254..). In order to bond these interfaces to the internal network, I had to first zero out the IP address of the interface. Once the interface IP address is set to 0.0.0.0/0, it because available to add to the internal switch.

Toshi_Esumi
Esteemed Contributor III

I know you already figured out but we always remove the default IP by "unset ip" under the interface and remove DHCP for the interface "del n(depending on the entity number)" to move any interface config around. 

sanderl
New Contributor III

Can the internalA and internalB ports on a FortiWfi 60D POE be combined with the internal ports in a HARDWARE switch?

Labels
Top Kudoed Authors