Example VLAN configuration in NAT mode

In this example two different internal VLAN networks share one interface on the FortiGate unit, and share the connection to the Internet. This example shows that two networks can have separate traffic streams while sharing a single interface. This configuration could apply to two departments in a single company, or to different companies.

There are two different internal network VLANs in this example. VLAN_100 is on the 10.1.1.0/255.255.255.0 subnet, and VLAN_200 is on the 10.1.2.0/255.255.255.0 subnet. These VLANs are connected to the VLAN switch, such as a Cisco 2950 Catalyst switch.

The FortiGate internal interface connects to the VLAN switch through an 802.1Q trunk. The internal interface has an IP address of 192.168.110.126 and is configured with two VLAN subinterfaces (VLAN_100 and VLAN_200). The external interface has an IP address of 172.16.21.2 and connects to the Internet. The external interface has no VLAN subinterfaces.

 

FortiGate unit with VLANs in NAT mode

When the VLAN switch receives packets from VLAN_100 and VLAN_200, it applies VLAN ID tags and forwards the packets of each VLAN both to local ports and to the FortiGate unit across the trunk link. The FortiGate unit has policies that allow traffic to flow between the VLANs, and from the VLANs to the external network.

This section describes how to configure a FortiGate unit and a Cisco Catalyst 2950 switch for this example network topology. The Cisco configuration commands used in this section are IOS commands.

It is assumed that both the FortiGate unit and the Cisco 2950 switch are installed and connected and that basic configuration has been completed. On the switch, you will need to be able to access the CLI to enter commands.

Refer to the manual for your FortiGate model as well as the manual for the switch you select for more information.

It is also assumed that no VDOMs are enabled.

 

General configuration steps

The following steps provide an overview of configuring and testing the hardware used in this example. For best results in this configuration, follow the procedures in the order given. Also, note that if you perform any additional actions between procedures, your configuration may have different results.

1. Configure the FortiGate unit

• Configure the external interface
• Add two VLAN subinterfaces to the internal network interface
• Add firewall addresses and address ranges for the internal and external networks
• Add security policies to allow:
• the VLAN networks to access each other
• the VLAN networks to access the external network.

2. Configure the VLAN switch

 

Configure the FortiGate unit

Configuring the FortiGate unit includes:

 

Configure the external interface

The FortiGate unit’s external interface will provide access to the Internet for all internal networks, including the two VLANs.

 

To configure the external interface – web-based manager

1. Go to System > Network > Interface.

2. Select Edit for the external interface.

3. Enter the following information and select OK:

Addressing mode                     Manual

IP/Network Mask                       172.16.21.2/255.255.255.0

 

To configure the external interface – CLI

config system interface edit external

set mode static

set ip 172.16.21.2 255.255.255.0

end

 

Add VLAN subinterfaces

This step creates the VLANs on the FortiGate unit internal physical interface. The IP address of the internal interface does not matter to us, as long as it does not overlap with the subnets of the VLAN subinterfaces we are configuring on it.

The rest of this example shows how to configure the VLAN behavior on the FortiGate unit, configure the switches to direct VLAN traffic the same as the FortiGate unit, and test that the configuration is correct.

Adding VLAN subinterfaces can be completed through the web-based manager, or the CLI.

 

To add VLAN subinterfaces – web-based manager

1. Go to System > Network > Interface.

2. Select Create New.

3. Enter the following information and select OK:

Name                                           VLAN_100

Interface                                     internal

VLAN ID                                      100

Addressing mode                     Manual

IP/Network Mask                       10.1.1.1/255.255.255.0

Administrative Access             HTTPS, PING, TELNET

4. Select Create New.

5. Enter the following information and select OK:

Name                                           VLAN_200

Interface                                     internal

VLAN ID                                      200

Addressing mode                     Manual

IP/Network Mask                       10.1.2.1/255.255.255.0

Administrative Access             HTTPS, PING, TELNET

 

To add VLAN subinterfaces – CLI

config system interface edit VLAN_100

set vdom root

set interface internal set type vlan

set vlanid 100 set mode static

set ip 10.1.1.1 255.255.255.0

set allowaccess https ping telnet next

edit VLAN_200

set vdom root

set interface internal

end

set type vlan set vlanid 200 set mode static

set ip 10.1.2.1 255.255.255.0

set allowaccess https ping telnet

 

 

Add the firewall addresses

You need to define the addresses of the VLAN subnets for use in security policies. The FortiGate unit provides one default address, “all”, that you can use when a security policy applies to all addresses as a source or destination of a packet. However, using “all” is less secure and should be avoided when possible.

In this example, the “_Net” part of the address name indicates a range of addresses instead of a unique address. When choosing firewall address names, use informative and unique names.

 

To add the firewall addresses – web-based manager

1. Go to Firewall Objects > Address > Addresses.

2. Select Create New.

3. Enter the following information and select OK:

Name                                          VLAN_100_Net

Type                                            Subnet

Subnet / IP Range                     10.1.1.0/255.255.255.0

4. Select Create New.

5. Enter the following information and select OK:

Name                                          VLAN_200_Net

Type                                            Subnet

Subnet / IP Range                     10.1.2.0/255.255.255.0

 

To add the firewall addresses – CLI

config firewall address edit VLAN_100_Net

set type ipmask

set subnet 10.1.1.0 255.255.255.0 next

edit VLAN_200_Net set type ipmask

set subnet 10.1.2.0 255.255.255.0

end

 

Add the security policies

Once you have assigned addresses to the VLANs, you need to configure security policies for them to allow valid packets to pass from one VLAN to another and to the Internet.

You can customize the Security Policy display by including some or all columns, and customize the column order onscreen. Due to this feature, security policy screenshots may not appear the same as on your screen.

If you do not want to allow all services on a VLAN, you can create a security policy for each service you want to allow. This example allows all services.

 

To add the security policies – web-based manager

1. Go to Policy & Objects > Policy > IPv4 or Policy & Objects > Policy > IPv6 and select Create New.

2. Leave the Policy Type as Firewall and the Policy Subtype as Address.

3. Enter the following information and select OK:

Incoming Interface                   VLAN_100

Source Address                        VLAN_100_Net

Outgoing Interface                   VLAN_200

Destination Address                 VLAN_200_Net

Schedule                                    Always

Service                                       ALL

Action                                         ACCEPT

Enable NAT                                Enable

4. Select Create New.

5. Leave the Policy Type as Firewall and the Policy Subtype as Address.

6. Enter the following information and select OK:

Incoming Interface                   VLAN_200

Source Address                        VLAN_200_Net

Outgoing Interface                   VLAN_100

Destination Address                 VLAN_100_Net

Schedule                                    Always

Service                                       ALL

Action                                         ACCEPT

Enable NAT                                Enable

7. Select Create New.

8. Leave the Policy Type as Firewall and the Policy Subtype as Address.

9. Enter the following information and select OK:

Incoming Interface                   VLAN_100

Source Address                        VLAN_100_Net

Outgoing Interface                   external

Destination Address                 all

Schedule                                    Always

Service                                       ALL

Action                                         ACCEPT

Enable NAT                                Enable

10. Select Create New.

11. Verify the Policy Type is Firewall and the Policy Subtype is Address.

12. Enter the following information and select OK:

Incoming Interface                   VLAN_200

Source Address                        VLAN_200_Net

Outgoing Interface                   external

Destination Address                 all

Schedule                                    Always

Service                                       ALL

Action                                         ACCEPT

Enable NAT                                Enable

 

To add the security policies – CLI

config firewall policy or  Config firewall policy6 edit 1

set srcintf VLAN_100

set srcaddr VLAN_100_Net set dstintf VLAN_200

set dstaddr VLAN_200_Net set schedule always

set service ALL set action accept set nat enable

set status enable next

edit 2

set srcintf VLAN_200

set srcaddr VLAN_200_Net set dstintf VLAN_100

set dstaddr VLAN_100_Net set schedule always

set service ALL set action accept set nat enable

set status enable next

edit 3

set srcintf VLAN_100

set srcaddr VLAN_100_Net set dstintf external

set dstaddr all

set schedule always set service ALL

set action accept set nat enable

set status enable next

edit 4

set srcintf VLAN_200

set srcaddr VLAN_200_Net set dstintf external

set dstaddr all

set schedule always set service ALL

set action accept set nat enable

set status enable

end

 

Configure the VLAN switch

On the Cisco Catalyst 2950 Catalyst VLAN switch, you need to define VLANs 100 and 200 in the VLAN database, and then add a configuration file to define the VLAN subinterfaces and the 802.1Q trunk interface.

One method to configure a Cisco switch is to connect over a serial connection to the console port on the switch, and enter the commands at the CLI. Another method is to designate one interface on the switch as the management interface and use a web browser to connect to the switch’s graphical interface. For details on connecting and configuring your Cisco switch, refer to the installation and configuration manuals for the switch.

The switch used in this example is a Cisco Catalyst 2950 switch. The commands used are IOS commands. Refer to the switch manual for help with these commands.

 

To configure the VLAN subinterfaces and the trunk interfaces

Add this file to the Cisco switch:

!

interface FastEthernet0/3 switchport access vlan 100

!

interface FastEthernet0/9 switchport access vlan 200

!

interface FastEthernet0/24

switchport trunk encapsulation dot1q switchport mode trunk

!

The switch has the configuration:

Port 0/3                         VLAN ID 100

Port 0/9                         VLAN ID 200

Port 0/24                       802.1Q trunk

To complete the setup, configure devices on VLAN_100 and VLAN_200 with default gateways. The default gateway for VLAN_100 is the FortiGate VLAN_100 subin- terface. The default gateway for VLAN_200 is the FortiGate VLAN_200 subinterface.

 

Test the configuration

Use diagnostic commands, such as tracert, to test traffic routed through the FortiGate unit and the Cisco switch.

 

Testing traffic from VLAN_100 to VLAN_200

In this example, a route is traced between the two internal networks. The route target is a host on VLAN_200. Access a command prompt on a Windows computer on the VLAN_100 network, and enter the following command:

 

C:\>tracert 10.1.2.2

Tracing route to 10.1.2.2 over a maximum of 30 hops:

1 <10 ms <10 ms <10 ms 10.1.1.1

2 <10 ms <10 ms <10 ms 10.1.2.2

Trace complete.

 

Testing traffic from VLAN_200 to the external network

In this example, a route is traced from an internal network to the external network. The route target is the external network interface of the FortiGate-800 unit.

From VLAN_200, access a command prompt and enter this command:

C:\>tracert 172.16.21.2

Tracing route to 172.16.21.2 over a maximum of 30 hops:

1 <10 ms <10 ms <10 ms 10.1.2.1

2 <10 ms <10 ms <10 ms 172.16.21.2

Trace complete.