Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
userzer0
New Contributor II

Host isolation?

Can you block intra subnet traffic with a fortiswitch, similar to how you can block intra subnet/ssid traffic with a fortiap? I'm setting up a network for iot devices, I dont want them to talk to each other and would rather not have to setup a /30 for each device. Thanks in advance
4 REPLIES 4
tanr
Valued Contributor II

I think you want private vlans, which Fortinet calls access vlans.  See https://help.fortinet.com/fos60hlp/60/Content/FortiOS/fortigate-managing-fortiswitch/GlobalCLIconfig... for details.

 

The medium and higher level FortiSwitches support this, but I don't think the 1xxD or 1xxE switches do.

userzer0
New Contributor II

Thanks for the info! I think the switch I'm using is a 108-fpoe, so it sounds like that isn't an option. Bit of a tangent, but if I may ask... are the terms native and allowed vlan similar to untagged and tagged vlans? I haven't been able to find a description of either.
tanr
Valued Contributor II

Native vlan is the vlan that an untagged frame gets assigned by default.

Allowed is (usually) other vlan IDs that are allowed on that port.

 

If you're working with FortiGate managed switches using 3.6.x firmware you can't force tagged or untagged frames on a port from the GUI or even the FortiGate's CLI.  You can ssh to the switch, though, and set it for a specific port, by setting discard-mode to all-tagged or all-untagged.

 

If you're running a FortiGate on 6.0.x and a managed FortiSwitch on 6.0.x you can set the same thing, just from the config switch-controller managed-switch section.

 

BTW, I'd recommend you don't use and don't delete vlan1.  IIRC, it may be used by the FortiSwitch.

ebilcari
Staff
Staff

If the switch is managed by FGT in Fortilink mode you can use it the same way like for FortiAPs, it's called Block intra-VLAN traffic and is applied at VLAN configuration level

intra vlan.PNG

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
Labels
Top Kudoed Authors