Hot!Add VLAN sub interfaces to a fisical interface

Author
hgg
New Member
  • Total Posts : 10
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/06/05 10:05:12
  • Status: offline
2018/06/05 10:16:43 (permalink)
0

Add VLAN sub interfaces to a fisical interface

Hi
 
Right now i have a network in production with no VLANS, a change in circunstances force me to create several VLANS to better segment our network and improve our security.
 
My question is:
 
Can i add VLAN Sub interfaces to our, currently in production, VLANless physical interface without consequences or should i create a new interface for the previous physical interface (for example as VLAN 1 or native) beside the new ones with the issues this will bring (DHCP among others)?
 
Thank in advance
#1

9 Replies Related Threads

    Toshi Esumi
    Expert Member
    • Total Posts : 966
    • Scores: 56
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: Add VLAN sub interfaces to a fisical interface 2018/06/05 16:53:14 (permalink)
    0
    I think I answered to your question on a different thread. Please avoid cross-threads for the same issue.
    #2
    ericli_FTNT
    Gold Member
    • Total Posts : 127
    • Scores: 4
    • Reward points: 0
    • Joined: 2018/02/08 11:12:27
    • Status: offline
    Re: Add VLAN sub interfaces to a fisical interface 2018/06/05 17:25:52 (permalink)
    0
    Definitely you can but I'm wondering how did you configure the other end? If it's another Fortigate, it should be ok. If it's a switch, trunk or access mode?
    #3
    sw2090
    Silver Member
    • Total Posts : 102
    • Scores: 8
    • Reward points: 0
    • Joined: 2017/06/14 01:27:25
    • Status: offline
    Re: Add VLAN sub interfaces to a fisical interface 2018/06/06 07:41:41 (permalink)
    0
    Generally its not a good idea to use vid 1 because on many managaeable switches this is the default vid and might screw your networking in consequence.
    So better use something else on your FGT to create virtual vlan interfaces. Then they will not interfere with your productive networking so far. You will of course need policies on your FGT for your vlans and you will have to do Port-Vlan-Setup on your switches to distribute your vlans further.
    Vlan interfaces on a FGT are btw always untagged in that vlans - i.e. packets that go out via the vlan interface will be tagged with its vid by the FGT even if they are already tagged. On most Switches you can choose if you want the port tagged/untagged or more options.
    #4
    hgg
    New Member
    • Total Posts : 10
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/06/05 10:05:12
    • Status: offline
    Re: Add VLAN sub interfaces to a fisical interface 2018/06/07 07:31:15 (permalink)
    0
    Thanks sw2090
     
    But i have a question.
     
    When you say "So better use something else on your FGT to create virtual vlan interfaces.", what do you mean?
     
    My problem is i have a lot of devices i need to move to the VLANS without thenm stop working, so they will stay in the current VLAN until i move them in an orderly fashion to their proper VLANs.
     
    I have a physical interface where all my network arrives right now, what worries me is that in a Cisco enviroment the root interface can not have IP address, only the sub interfaces. What i understand from your answer and from others who answered this post is that i can create a VLAN Interface over this physical interface, assign it IP address and everything will work as if nothing has happened. My physical interface and the new VLAN interface both with IP Addresses will work seamessly, Am i right?
     
    #5
    hgg
    New Member
    • Total Posts : 10
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/06/05 10:05:12
    • Status: offline
    Re: Add VLAN sub interfaces to a fisical interface 2018/06/07 07:38:25 (permalink)
    0
    Hi Toshi
     
    I ask you to forgiveme .
     
    It is not quite the same question, this question is about leave everything as it is and add VLAN interfaces over my current interface.  The other question was about move a physical interface to a VLAN interface in a manner that do not require to rebuild everything.
     
    Thanks for your comprension.
    #6
    hgg
    New Member
    • Total Posts : 10
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/06/05 10:05:12
    • Status: offline
    Re: Add VLAN sub interfaces to a fisical interface 2018/06/09 05:49:51 (permalink)
    0
    All my network runs in the native (VLAN 1) VLAN in switchs HP.  This is something i need to change but i am affraid to do it over a production network with a bunch of devices.  I need that everything keep working while i'm implementing the VLANs.
     
    This is the info you needed?
    #7
    ericli_FTNT
    Gold Member
    • Total Posts : 127
    • Scores: 4
    • Reward points: 0
    • Joined: 2018/02/08 11:12:27
    • Status: offline
    Re: Add VLAN sub interfaces to a fisical interface 2018/06/11 09:26:46 (permalink)
    0
    Thanks for reply!
     
    I understand all your network is running within native vlan. But if you need to create a new vlan interface, you need to make sure the port on your HP switch can accept it's vlanid. therefore, it should be in trunking mode.
    #8
    rwpatterson
    Expert Member
    • Total Posts : 8230
    • Scores: 177
    • Reward points: 0
    • Joined: 2006/08/08 10:08:18
    • Location: Long Island, New York, USA
    • Status: online
    Re: Add VLAN sub interfaces to a fisical interface 2018/06/11 11:02:53 (permalink)
    0
    In your situation, I would create a second trunk interface, define all of your VLANs there, then move devices to the new VLAN (and trunk) after testing the link with a test device on that VLAN for connectivity. Once you are sure the switches route correctly to the 40gate, then flip the port (on the switch) that the server is on to the confirmed good VLAN. This can be done on a machine by machine basis. No big forklift overhaul and you don't affect the running environment until you move that single device.
     
    My two cents

    -Bob - self proclaimed posting junkie!
    See my Fortigate related scripts at: http://fortigate.camerabob.com

    -4.3.18-b0689
    FWF60B
    FWF80CM (4)
    FWF81CM (2)
     
    #9
    hgg
    New Member
    • Total Posts : 10
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/06/05 10:05:12
    • Status: offline
    Re: Add VLAN sub interfaces to a fisical interface 2018/06/16 06:50:25 (permalink)
    0
    Hi ericcli
     
    Yes, i'm pretty sure HP switchs (1920 most of them, some 1910) are able to accept vlans id.
     
    I don't think HP switchs, at least not 1920s, use the "trunk" concept as in the Cisco world, in HP the vlans are tagged or untagged for a particular interface. So i should configure the required VLANs in all my switchs, configure the respective VLAN in each port as tagged and in the "trunk" interface i should add as tagged all VLANs that are going to pass through the interface to the next device or router, am i right?
     
    If i add a vlan interface to the physical interface but i don't have configured vlans in the switchs it won't cause any problems to currently running network, do you agree?, or is it i should first and foremost setup vlans in the switchs?, i know i will have to do it eventually, but can i add the vlan interface to the physical interface without causing any interruptions?
    #10
    Jump to:
    © 2018 APG vNext Commercial Version 5.5