Hot!fortiwifi - vlan id- switch

Author
concha
New Member
  • Total Posts : 1
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/07/24 07:49:55
  • Status: offline
2020/07/24 07:56:39 (permalink)
0

fortiwifi - vlan id- switch

Hi!
I have a PC connected to a fortiwifi by cable
The fortiwifi connected to a Firewall.
Vlans in the firewall
I need the fortiwifi to work as a switch and divide the ports into vlan groups.
I need to have connectivity from the pc to the vlan of the FW. For this, the PC is connected to one port of the fortiwifi and another port to the fw.
The pc sends untagged traffic but I need the forti to be tagged and sent to the fw with the tag of the vlan that I want to ping its ip.
How can I configure fortiwifi to do this? I have configured it as a hardware switch but I do not know how to label with the vlanid.
Thank you very much
#1

9 Replies Related Threads

    sw2090
    Expert Member
    • Total Posts : 712
    • Scores: 50
    • Reward points: 0
    • Joined: 2017/06/14 01:27:25
    • Location: Regensburg
    • Status: offline
    Re: fortiwifi - vlan id- switch 2020/07/25 09:06:09 (permalink)
    0
    I cannot speak for FortiWifi as I have no such device.
    But usually in FortiOS Vlans are virtual Interfaces that are always untagged in the given vlan.
    This means traffic that flows onto this interface will leave the interface tagged with the vid of the specific vlan.
    This is FortiOS default behaviour.
    #2
    SecurityPlus
    Gold Member
    • Total Posts : 346
    • Scores: 4
    • Reward points: 0
    • Joined: 2014/08/11 18:41:34
    • Status: offline
    Re: fortiwifi - vlan id- switch 2020/07/25 09:36:41 (permalink)
    0
    I'm not sure I understand the layout of your network. Does the FortiWifi connect to a separate firewall which in turn connects to a modem? What ForitOS are you using?

    FWF30E, FG50E, FWF50E, FG60D, FWF60D, FG60E, FG60F, FG80E, FG100D
    FortiOS 5.2, 5.4, 5.6, and 6.0
    FortiSwitch FS-224E-POE
    FAP-221E, FAP-221C
    #3
    brycemd
    Silver Member
    • Total Posts : 105
    • Scores: 6
    • Reward points: 0
    • Joined: 2016/12/03 11:24:30
    • Status: offline
    Re: fortiwifi - vlan id- switch 2020/07/25 10:41:37 (permalink)
    0
    It would be best if you just got a switch to handle the taggings(or just have the end device tag itself), but if you insist on using the gate to get untagged traffic onto a vlan...
     
    On a fortiwifi it comes as a software switch by default, so you may need to break out physical ports in the cli
     
    You need to create the vlan and leave it as 0.0.0.0/0.0.0.0 and ensure it has no references. The physical port will need to be the same, 0.0.0.0/0.0.0.0 and no references, then create a software switch with the IP/subnet you want and then add the vlan and the physical port to that software switch. It essentially creates a bridge between the two interfaces.
     
    This will make that physical port untagged on that vlan. There are several downsides to this, but the fortigate isn't really meant to replace a switch.
     
    I guess the question is do you actually need vlans, or would simply breaking off a couple of ports into a new hardware switch would do what you want.
    post edited by brycemd - 2020/07/25 10:56:34
    #4
    sw2090
    Expert Member
    • Total Posts : 712
    • Scores: 50
    • Reward points: 0
    • Joined: 2017/06/14 01:27:25
    • Location: Regensburg
    • Status: offline
    Re: fortiwifi - vlan id- switch 2020/07/27 04:46:40 (permalink)
    0
    In FortiOS as I said a vlans are  treated as virtual interface that is untagged in that vlan.
    This means that interface can have some ip out of some subnet or even do dhcp if needed.
    It also means that all packets that leave the FortiOS Device coming from this interface will be tagged with the interface's vid.
    you do not neccessary have to break off the software switch. Switch is also a virtual interface and you can attach vlan interfaces to it.
    That would just mean that your FortiOS device would distribute vlan packets tagged with the vid over every single port that is member of that software switch.
    #5
    brycemd
    Silver Member
    • Total Posts : 105
    • Scores: 6
    • Reward points: 0
    • Joined: 2016/12/03 11:24:30
    • Status: offline
    Re: fortiwifi - vlan id- switch 2020/07/27 06:25:19 (permalink)
    0
    I think you are confusing untagged with tagged. To reach any vlans on the fortigate the packet will need to arrive at the fortigate as tagged for that vlan. A computer plugged directly into the fortigate will end up on the untagged vlan(the physical interface) which is vlan0 unless the device tags itself.
    #6
    sw2090
    Expert Member
    • Total Posts : 712
    • Scores: 50
    • Reward points: 0
    • Joined: 2017/06/14 01:27:25
    • Location: Regensburg
    • Status: offline
    Re: fortiwifi - vlan id- switch 2020/07/27 06:44:30 (permalink)
    0
    No I only sopoke of packets that go out from FortiOS Vlan Interface. Their vlan tag will be rewiritten to the interface's one. That is what untagged means.
     
    In the incoming direction you are right. Packets have to be tagged already to fit the vlan.
     
    Basically: 
     
    untagged == vlan tag will be rewritten on outgoing packets. Incoming packets must have correct vlan tag.
    tagged == vlan tag will not be touched on outgoing packets. Incomind packets must have correct vlan tag.
     
    #7
    brycemd
    Silver Member
    • Total Posts : 105
    • Scores: 6
    • Reward points: 0
    • Joined: 2016/12/03 11:24:30
    • Status: offline
    Re: fortiwifi - vlan id- switch 2020/07/27 06:52:38 (permalink)
    0
    That's not really correct.. untagged vlans get written as they enter and removed as they leave, tagged just needs to be there to accept the vlan otherwise it gets discarded.
     
    Either way, it's beside the point. FortiGate is not meant to replace a switch, and to get a dumb device onto a vlan on a FortiGate you need a software switch to bridge the physical interface and vlan.
     
    Ultimately, in this scenario, the issue is you cannot define on a fortigate what the 'untagged' vlan is. It will always be vlan0, the physical interface.
    post edited by brycemd - 2020/07/27 07:09:59
    #8
    sw2090
    Expert Member
    • Total Posts : 712
    • Scores: 50
    • Reward points: 0
    • Joined: 2017/06/14 01:27:25
    • Location: Regensburg
    • Status: offline
    Re: fortiwifi - vlan id- switch 2020/07/27 07:23:56 (permalink)
    0
    I agree with you for the first point. 
     
    The second is not correct in FortiOS.
    In FOrtiOS you need a policy that allows the traffic from lan to vlan with the speiic ones aus dst/src interface and that's it. That is the big advantage of vlans being treated as virtual interfaces. Since the vlan interface is untagged in FortiOS the vlan tag gets rewritten and the policy does the rest.
     
    I do that with various vlans on my FGT here to connect e.g. coming from an IPSec Tunnel or a physical port and going to a vlan.
     
    #9
    rwpatterson
    Expert Member
    • Total Posts : 8490
    • Scores: 205
    • Reward points: 0
    • Joined: 2006/08/08 10:08:18
    • Location: Long Island, New York, USA
    • Status: online
    Re: fortiwifi - vlan id- switch 2020/07/27 07:42:09 (permalink)
    0
    @concha
     
    Do you want to present multiple VLANs to the AP and have the AP present these separate VLANs to the access ports?

    -Bob - self proclaimed posting junkie!
    See my Fortigate related scripts at: http://fortigate.camerabob.com

    -4.3.19-b0694
    FWF80CM (2)
    FWF81CM (3)
     
    #10
    Jump to:
    © 2020 APG vNext Commercial Version 5.5