Help with Setting Up VLANs

[ljustman]

Hello,

I work at a school, primarily as a teacher, but handle the tech for the building as well. I am very new to enterprise networking, and I am hitting a brick wall with setting up vlans. This seems like it should be pretty simple from what I have read, but I can't seem to make it work.

We have a Fortinet 100E Firewall that goes out to Aruba switch A. Aruba Switch A goes out to Aruba Switch B and two Ubiquiti wireless access points. Aruba Switch B goes out to 5 wireless access points. The goal is to create three wireless networks-- one for staff, one for students, and one for guests.

I created the VLAN IDs on the Fortinet and the Aruba switches. I associated a wireless network SSID on the Ubiquiti controller with each vlan ID.

I am still not 100% sure on the right combination of tagged/untagged/trunk ports-- but I think I have tried every possible combination. The closest I have gotten to things working as intended is tagging all ports involved on the Arubas. That leaves me with working DHCP handling (in the proper VLAN IP range), but no internet access.

Sorry if my terminology doesn't quite make sense... I'm definitely learning all this as I go! If anyone needs clarification, just ask. Thank you in advance for your help.

[tanr]

If you're unsure about this, I'd recommend seeing if the school can bring in a consultant to bring you up to speed, or find a parent with a networking background who can volunteer their time.  Might save you and the school a lot of trouble in the end.

Besides looking through the main manuals and admin guides, check the cookbook articles at https://cookbook.fortinet.com/ and especially https://cookbook.fortinet.com/getting-started/ for your appropriate FortiOS version (which is?).   You might need to look at recipes from 5.4 as not all recipes have been ported to 5.6.

A really good (though getting out of date) book on working with FortiGates is UTM Security with Fortinet: Mastering FortiOS: https://www.amazon.com/UTM-Security-Fortinet-Mastering-FortiOS/dp/1597497479

FortiGate vlan interfaces, created on top of its physical interfaces, are tagged only.  The FortiGate doesn't work with untagged (native) vlans.  So make sure your switches are using tagged trunk ports in their communication with each other, the FortiGate, and the Ubiquiti controllers.

I assume you've got the FortiGate working as the DHCP server for each vlan?  Or are you serving them from the Ubiquiti APs?  Unrelated notes: You'll need to make sure your APs are managed in a way that lets them hand off connections as users move around the building.  And you'll need to think about how you authenticate users.

It sounds like your users are connecting to wifi and getting IPs, but can't get out to the internet.

Do they have local connectivity?  For example, if you enable PING on the vlan interface of the FortiGate, can they ping that IP?

For getting access to the internet, you need both a default route to your wan interface, and appropriate security policies allowing traffic from the specific vlans to the wan interface.  I would recommend that you put your various interfaces into zones (create zones on the interface page and add interfaces to them).  Then create your security policies using the zones instead of the interfaces.  This makes changing around interfaces later much easier.

[capricorn80]

Create thress VLAN let say 400,401 and 402

on Aruba you can do vlan 400-402 and it will create VLAN.

Trunk the ports between Aruba A and Aruba as your access points are connected to it.

you need to allow these three vlans on trunk between switches.

Then create a trunk port that will connect from Switch A to Fortigate.

on Fortigate gate  select one interface -> Create New -> interface -> Student

-> type VLAN -> interface select the Port number that is connected to Aruba switch.

VLAN ID: 400 - Role LAN

Address: Take any address range that is not in use. Let see 10.10.10.1/24

Administrative Access -> select ping to test connectivity. 

Repeat the same step to create different VLAN number like 401 and 403 and take different address range.

Vlan 400: 10.10.10.1/24

Vlan 401: 10.10.10.1/24

Vlan 402: 10.10.10.1/24

On switch port that is connected to Aruba. Tagged vlan 400,401 and 402 and untagged managed VLAN for AP.

Create Zone in Firewall with name Wireless and Add all these three virtual interfaces in it. This way you will just create one policy to give internet access to all SSID.

Let me know if you need more info

[capricorn80]

I read your last comment now. BTW why you want to use three different public IP for three SSID?

 You can use the NAT option under IPV4 Policy.

[ljustman]

Hey Capticorn80.

I am using Blocksi, a DNS based web filtering service. The goal is to have each interface isolated to a public IP. Each public IP entered in Blocksi can have a different web filtering policy in place.

I follow what you are saying, but haven't been able to get it to work thus far.... I created an IP pool with one external IP in it and set it to one to one. Then I set that IP pool for the NAT section of my policy. When I do that, I no longer have internet access.

Am I doing something wrong?

[capricorn80]

what outgoing interface are you using in your policy?

can you write your policy here like

incoming interface

outgoing interface

you dont need to write your exact Public IP.

[Toshi_Esumi]

Sounds very exciting for your new assignment. You must be a science or math teacher.

I don't know how to configure Aruba switch and Ubiquiti APs, but if you want the FG100E to provide DHCP server to each SSID client, you have to have vlan subinterfaces on the 100E. Since everything is coming through Aruba switch, I would connect only one physical interface of 100E to Aruba-A and build all vlans on it (unless combined traffic toes beyond 1Gbps). FortiGate vlan interfaces are always tagged (no untagged vlan is supported), so you need to make Aruba-A side as a "trunk" port and likely need to make the AP side as "trunk" as well to pass the SSID vlan to the AP. I'm assuming the AP has an option to make SSID "bridged" with a vlan tag like many other APs while AP management plane connects to non-tagged interface, probably a part of the physical(parent) interface on the 100E side, which is non-tagged.

Others in this forum might have experience with Aruba SW and/or Ubiquiti AP configuration.

Toshi

[rwpatterson]

Sounds like you are 90% there. On the egress policies, make sure NAT is enabled. Private IPs are terminated at the ISP equipment and are not sent out to the Internet, so without NAT, you get no Internet. From any connected device, run a traceroute and you will see how far your traffic goes before it dies. A very easy way to spot the bump in the road.

[ITadm]

I'm setting up something similar atm :). 

I'm not an expert, but I think it should look like this (example ports):

Fortigate 100E  -- port 2 to port 1 --> Aruba A -- port 20 to port 1 --> Aruba B -- port 4,5,6 --> APs with multi SSID

VLAN 1,2,3,4

VLAN1,2,3,4 on A should be tagged to port 1 and port 20, if the switch has some APs connected, their ports should be tagged to needed VLANs. So, when you just want to send VLAN traffic to another device you just tag the port, 0 ports should be untagged unless you want to plug for instance 1 PC for VLAN 1, then you untag traffic to proper port to VLAN 1.

On B VLAN 1,2,3,4 should be tagged to port 1 and 4,5,6. You have to add all VLANs with correct IDs and names on every device.

The fun part is setting up Fortigate 100E itself, creating firewall policies and creating flow between the VLANs and WAN, but there are plenty of high quality videos about it provided by Fortigate.

It works for me, maybe it will help you too :)

Goodluck! 

[ljustman]

Hey all-- thank you for your help. I am sorry for not replying sooner; it has been a hectic start to the school year. Your advice was helpful. I didn't at all think about poilicy/nats and setting those up was all I needed to do!

This is kind of unrelated, but the next part of this setup is pointing each of these vlans to a different IP address provided by the ISP. I know they are going to give me a /29 block of IP addresses.... what's the best way to add this to my fortigate and point each vlan (staff, student, and guest) at its own IP? 

I am using a DNS based web filter (Blocksi) and the plan is to configure different policies there. The Blocksi folks tell me I can point a policy at a specific Public IP.