Hot!internal routing multiple subnets 1 physical port

Author
jbrowne
New Member
  • Total Posts : 5
  • Scores: 0
  • Reward points: 0
  • Joined: 2016/11/21 11:28:02
  • Status: offline
2019/01/03 08:27:48 (permalink)
0

internal routing multiple subnets 1 physical port

In the past, I setup a FG100D with multiple internal subnets by using multiple physical ports on the Fortigate and assigning the IPs to those ports as gateways, so each internal subnet could talk to each other.
 
I'm setting up a FG100D at a different company with similar needs.  I was trying to make it simpler by using a single physical LAN port on the Fortigate - possible ?
 
subnets=  192.168.1.0 ,  192.168.8.0 , 192.168.37.0 , 192.168.41.0   
each having a gateway of .x.250  (192.168.1.250....etc....)
 
These should each have access to the other.
And these should each have access to the WAN port.
 
Must I use multiple LAN ports ?
thanks.
#1

7 Replies Related Threads

    Silver
    Gold Member
    • Total Posts : 265
    • Scores: -1
    • Reward points: 0
    • Joined: 2013/02/25 00:43:47
    • Status: offline
    Re: internal routing multiple subnets 1 physical port 2019/01/03 08:43:24 (permalink)
    0
    Hello,
     
    Yes this can be achieved by using sub interface. 
    Thanks
    #2
    Dave Hall
    Expert Member
    • Total Posts : 1371
    • Scores: 144
    • Reward points: 0
    • Joined: 2012/05/11 07:55:58
    • Location: Canada
    • Status: offline
    Re: internal routing multiple subnets 1 physical port 2019/01/03 09:13:22 (permalink)
    0
    If the company's network is segmented by department, you may be better off using vlans on the physical LAN port, assuming you are able to implement/configure vlans on the network switches and/or devices directly. 
     
    If the company is small and/or does not see a lot of network traffic, you could just create a class B or classless subnet at the private level (eg. 10.10.x.x or 192.168.x.x).
     
    If you need to have multiple subsets on a physical interface, you could create/bind secondary IPs to an interface and use hairpin policies to route traffic.  See KB FD30118.  See also FD30014 regarding overlapping subnets.
     
    Personally, I would use vlans if possible or multiple physical ports.
    post edited by Dave Hall - 2019/01/03 09:18:53

    NSE4/FMG-VM64/FortiAnalyzer-VM/5.2/5.4 (FWF40C/FW92D/FGT200B/FGT200D/FGT101E)/ FAP220B/221C
    #3
    jbrowne
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/11/21 11:28:02
    • Status: offline
    Re: internal routing multiple subnets 1 physical port 2019/01/03 09:21:32 (permalink)
    0
    @Silver - thanks for suggestion.
     
    @Dave Hall  - I tried the secondary IPs (KB FD30118) - but it didn't seem to work.
     
    of course, I'm not an expert on IP addressing or routing.
    all the end points have class C netmasks and single IPs.
     
    I'm trying to make the Fortigate's setup as simple as possible with as few steps.
     
    I was also looking at https://cookbook.fortinet.com/using-zones-to-simplify-firewall-policies-56/
    but haven't finished the steps yet.
     
    #4
    jbrowne
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/11/21 11:28:02
    • Status: offline
    Re: internal routing multiple subnets 1 physical port 2019/01/03 09:21:32 (permalink)
    0
    @Silver - thanks for suggestion.
     
    @Dave Hall  - I tried the secondary IPs (KB FD30118) - but it didn't seem to work.
     
    I'm trying to make the Fortigate's setup as simple as possible with as few steps.
     
    I was also looking at https://cookbook.fortinet.com/using-zones-to-simplify-firewall-policies-56/
    but haven't finished the steps yet.
     
    #5
    Dave Hall
    Expert Member
    • Total Posts : 1371
    • Scores: 144
    • Reward points: 0
    • Joined: 2012/05/11 07:55:58
    • Location: Canada
    • Status: offline
    Re: internal routing multiple subnets 1 physical port 2019/01/03 11:10:56 (permalink)
    0
    The hairpining scenario (KB FD30118) should work providing those secondary IPs (binded to the primary interface) show up in the routing table, attached to the same Interface and you have created the hairpin policy(ies).
     
    The cookbook recipe you are referring to, is built on having vlans setup on your switch(es) - is this the case?
     
     

    NSE4/FMG-VM64/FortiAnalyzer-VM/5.2/5.4 (FWF40C/FW92D/FGT200B/FGT200D/FGT101E)/ FAP220B/221C
    #6
    jbrowne
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/11/21 11:28:02
    • Status: offline
    Re: internal routing multiple subnets 1 physical port 2019/01/03 11:14:53 (permalink)
    0
    I've been playing with it all day today. different scenarios / setups.
    I'm trying to stay away from vlans.
     
    currently (working)  I'm back to using multiple physical interfaces with an IP/subnet assigned per interface.  All physical interfaces plugged into the same switch.  And, I'm using a Zone on the Fortigate with all these physical interfaces in one Zone.
     
     
    #7
    lobstercreed
    Gold Member
    • Total Posts : 125
    • Scores: 21
    • Reward points: 0
    • Joined: 2018/11/28 14:57:58
    • Location: Sedalia, MO
    • Status: offline
    Re: internal routing multiple subnets 1 physical port 2019/01/27 14:53:49 (permalink)
    0
    @jbrowne, coming late to this thread, I am curious why you are trying to stay away from VLANs?  They're the best!  :-)  Unless of course your switch hardware is unmanaged or something...
     
    We use our FortiGate to chop up our network every which way, using zones to group like policies together but we still have about 2 dozen VLANs on 3 physical interfaces.
    #8
    Jump to:
    © 2019 APG vNext Commercial Version 5.5