VLANs
Virtual Local Area Networks (VLANs) multiply the capabilities of your FortiGate unit and can also provide added network security. VLANs use ID tags to logically separate devices on a network into smaller broadcast domains. These smaller domains forward packets only to devices that are part of that VLAN domain. This reduces traffic and increases network security.
VLANs in NAT mode
In NAT mode, the FortiGate unit functions as a layer-3 device. In this mode, the FortiGate unit controls the flow of packets between VLANs and can also remove VLAN tags from incoming VLAN packets. The FortiGate unit can also forward untagged packets to other networks such as the Internet.
In NAT mode, the FortiGate unit supports VLAN trunk links with IEEE 802.1Q-compliant switches or routers. The trunk link transports VLAN-tagged packets between physical subnets or networks. When you add VLAN subinterfaces to the FortiGate’s physical interfaces, the VLANs have IDs that match the VLAN IDs of packets on the trunk link. The FortiGate unit directs packets with VLAN IDs to subinterfaces with matching IDs.
You can define VLAN subinterfaces on all FortiGate physical interfaces. However, if multiple virtual domains are configured on the FortiGate unit, you only have access to the physical interfaces on your virtual domain. The FortiGate unit can tag packets leaving on a VLAN subinterface. It can also remove VLAN tags from incoming packets and add a different VLAN tag to outgoing packets.
Normally in VLAN configurations, the FortiGate unit’s internal interface is connected to a VLAN trunk, and the external interface connects to an Internet router that is not configured for VLANs. In this configuration, the FortiGate unit can apply different policies for traffic on each VLAN interface connected to the internal interface, which results in less network traffic and better security.
Sample topology
In this example, two different internal VLAN networks share one interface on the FortiGate unit and share the connection to the Internet. This example shows that two networks can have separate traffic streams while sharing a single interface. This configuration can apply to two departments in a single company or to different companies.
There are two different internal network VLANs in this example. VLAN_100 is on the 10.1.1.0/255.255.255.0 subnet, and VLAN_200 is on the 10.1.2.0/255.255.255.0 subnet. These VLANs are connected to the VLAN switch.
The FortiGate internal interface connects to the VLAN switch through an 802.1Q trunk. The internal interface has an IP address of 192.168.110.126 and is configured with two VLAN subinterfaces (VLAN_100 and VLAN_200). The external interface has an IP address of 172.16.21.2 and connects to the Internet. The external interface has no VLAN subinterfaces.
When the VLAN switch receives packets from VLAN_100 and VLAN_200, it applies VLAN ID tags and forwards the packets of each VLAN both to local ports and to the FortiGate unit across the trunk link. The FortiGate unit has policies that allow traffic to flow between the VLANs, and from the VLANs to the external network.
Sample configuration
In this example, both the FortiGate unit and the Cisco 2950 switch are installed and connected and basic configuration has been completed. On the switch, you need access to the CLI to enter commands. No VDOMs are enabled in this example.
General configuration steps include:
- Configure the external interface.
- Add two VLAN subinterfaces to the internal network interface.
- Add firewall addresses and address ranges forthe internal and external networks.
- Add security policies to allow:
l the VLAN networks to access each other. l the VLAN networks to access the external network.
To configure the external interface:
config system interface edit external set mode static set ip 172.16.21.2 255.255.255.0
end
To add VLAN subinterfaces:
config system interface edit VLAN_100 set vdom root set interface internal set type vlan set vlanid 100 set mode static set ip 10.1.1.1 255.255.255.0 set allowaccess https ping telnet
next edit VLAN_200 set vdom root set interface internal set type vlan set vlanid 200 set mode static set ip 10.1.2.1 255.255.255.0 set allowaccess https ping telnet
end
To add the firewall addresses:
config firewall address edit VLAN_100_Net set type ipmask set subnet 10.1.1.0 255.255.255.0
next edit VLAN_200_Net set type ipmask set subnet 10.1.2.0 255.255.255.0
end
To add security policies:
Policies 1 and 2 do not need NAT enabled, but policies 3 and 4 do need NAT enabled.
config firewall policy edit 1 set srcintf VLAN_100 set srcaddr VLAN_100_Net set dstintf VLAN_200
set dstaddr VLAN_200_Net set schedule always set service ALL set action accept set nat disable set status enable
next edit 2 set srcintf VLAN_200
set srcaddr VLAN_200_Net set dstintf VLAN_100 set dstaddr VLAN_100_Net set schedule always set service ALL set action accept set nat disable set status enable
next edit 3 set srcintf VLAN_100 set srcaddr VLAN_100_Net set dstintf external set dstaddr all set schedule always set service ALL set action accept set nat enable set status enable
next edit 4 set srcintf VLAN_200 set srcaddr VLAN_200_Net set dstintf external set dstaddr all set schedule always set service ALL set action accept set nat enable set status enable
end
VLANs in transparent mode
In transparent mode, the FortiGate unit behaves like a layer-2 bridge but can still provide services such as antivirus scanning, web filtering, spam filtering, and intrusion protection to traffic. Some limitations of transparent mode is that you cannot use SSL VPN, PPTP/L2TP VPN, DHCP server, or easily perform NAT on traffic. The limits in transparent mode apply to IEEE 802.1Q VLAN trunks passing through the unit.
You can insert the FortiGate unit operating in transparent mode into the VLAN trunk without making changes to your network. In a typical configuration, the FortiGate unit internal interface accepts VLAN packets on a VLAN trunk from a VLAN switch or router connected to internal network VLANs. The FortiGate external interface forwards VLAN-tagged packets through another VLAN trunk to an external VLAN switch or router and on to external networks such as the Internet. You can configure the unit to apply different policies for traffic on each VLAN in the trunk.
To pass VLAN traffic through the FortiGate unit, you add two VLAN subinterfaces with the same VLAN ID, one to the internal interface and the other to the external interface. You then create a security policy to permit packets to flow from the internal VLAN interface to the external VLAN interface. If required, create another security policy to permit packets to flow from the external VLAN interface to the internal VLAN interface. Typically in transparent mode, you do not permit packets to move between different VLANs. Network protection features such as spam filtering, web filtering, and antivirus scanning, are applied through the UTM profiles specified in each security policy, enabling very detailed control over traffic.
When the FortiGate unit receives a VLAN-tagged packet on a physical interface, it directs the packet to the VLAN subinterface with the matching VLAN ID. The VLAN tag is removed from the packet and the FortiGate unit then applies security policies using the same method it uses for non-VLAN packets. If the packet exits the FortiGate unit through a VLAN subinterface, the VLAN ID for that subinterface is added to the packet and the packet is sent to the corresponding physical interface.
Sample topology
In this example, the FortiGate unit is operating in transparent mode and is configured with two VLANs: one with an ID of 100 and the other with ID 200. The internal and external physical interfaces each have two VLAN subinterfaces, one for VLAN_100 and one for VLAN_200.
The IP range for the internal VLAN_100 network is 10.100.0.0/255.255.0.0, and for the internal VLAN_200 network is 10.200.0.0/255.255.0.0.
The internal networks are connected to a Cisco 2950 VLAN switch which combines traffic from the two VLANs onto one in the FortiGate unit’s internal interface. The VLAN traffic leaves the FortiGate unit on the external network interface, goes on to the VLAN switch, and on to the Internet. When the FortiGate units receives a tagged packet, it directs it from the incoming VLAN subinterface to the outgoing VLAN subinterface for that VLAN.
In this example, we create a VLAN subinterface on the internal interface and another one on the external interface, both with the same VLAN ID. Then we create security policies that allow packets to travel between the VLAN_100_int interface and the VLAN_100_ext interface. Two policies are required: one for each direction of traffic. The same is required between the VLAN_200_int interface and the VLAN_200_ext interface, for a total of four security policies.
Sample configuration
There are two main steps to configure your FortiGate unit to work with VLANs in transparent mode:
- Add VLAN subinterfaces.
- Add security policies.
You can also configure the protection profiles that manage antivirus scanning, web filtering, and spam filtering.
To add VLAN subinterfaces:
config system interface edit VLAN_100_int set type vlan set interface internal set vlanid 100
next edit VLAN_100_ext set type vlan set interface external set vlanid 100
next edit VLAN_200_int set type vlan set interface internal set vlanid 200
next edit VLAN_200_ext set type vlan set interface external set vlanid 200
end To add security policies:
config firewall policy
edit 1
set srcintf VLAN_100_int set srcaddr all set dstintf VLAN_100_ext set dstaddr all set action accept set schedule always set service ALL
next edit 2
set srcintf VLAN_100_ext set srcaddr all set dstintf VLAN_100_int set dstaddr all set action accept set schedule always set service ALL
next edit 3
set srcintf VLAN_200_int set srcaddr all set dstintf VLAN_200_ext set dstaddr all set action accept set schedule always set service ALL
next edit 4
set srcintf VLAN_200_ext
set srcaddr all set dstintf VLAN_200_int set dstaddr all set action accept set schedule always set service ALL
end
Enhanced MAC VLANs
The Media Access Control (MAC) Virtual Local Area Network (VLAN) feature in Linux allows you to configure multiple virtual interfaces with different MAC addresses (and therefore different IP addresses) on a physical interface.
FortiGate implements an enhanced MAC VLAN consisting of a MAC VLAN with bridge functionality. Because each MAC VLAN has a unique MAC address, virtual IP addresses (VIPs) and IP pools are supported, and you can disable Source Network Address Translation (SNAT) in policies.
MAC VLAN cannot be used in a Transparent mode virtual domain (VDOM). In a Transparent mode VDOM, a packet leaves an interface with the MAC address of the original source instead of the interface’s MAC address. FortiGate implements an enhanced version of MAC VLAN where it adds a MAC table in the MAC VLAN which learns the MAC addresses when traffic passes through.
If you configure a VLAN ID for an enhanced MAC VLAN, it won’t join the switch of the underlying interface. When a packet is sent to this interface, a VLAN tag is inserted in the packet and the packet is sent to the driver of the underlying interface. When the underlying interface receives a packet, if the VLAN ID doesn’t match, it won’t deliver the packet to this enhanced MAC VLAN interface.
If you use an interface in an enhanced MAC VLAN, do not use it for other purposes such as a management interface, HA heartbeat interface, or in Transparent VDOMs.
If a physical interface is used by an EMAC VLAN interface, you cannot use it in a Virtual Wire Pair.
In high availability (HA) configurations, enhanced MAC VLAN is treated as a physical interface. It’s assigned a unique physical interface ID and the MAC table is synchronized with the slaves in the same HA cluster.
Example 1: Enhanced MAC VLAN configuration for multiple VDOMs that use the same interface or VLAN
In this example, a FortiGate is connected, through port 1 to a router that’s connected to the Internet. Three VDOMs share the same interface (port 1) which connects to the same router that’s connected to the Internet. Three enhanced MAC VLAN interfaces are configured on port 1 for the three VDOMs. The enhanced MAC VLAN interfaces are in the same IP subnet segment and each have unique MAC addresses.
The underlying interface (port 1) can be a physical interface, an aggregate interface, or a VLAN interface on a physical or aggregate interface.
To configure enhanced MAC VLAN for this example in the CLI:
config system interface edit port1.emacvlan1 set vdom VDOM1 set type emac-vlan set interface port1
next
edit port 1.emacvlan2 set vdom VDOM2 set type emac-vlan set interface port1
next
edit port1.emacvlan3 set vdom VDOM3 set type emac-vlan set interface port1
next
end
Example 2: Enhanced MAC VLAN configuration for shared VDOM links among multiple VDOMs
In this example, multiple VDOMs can connect to each other using enhanced MAC VLAN on network processing unit (NPU) virtual link (Vlink) interfaces.
FortiGate VDOM links (NPU-Vlink) are designed to be peer-to-peer connections and VLAN interfaces on NPU Vlink ports use the same MAC address. Connecting more than two VDOMs using NPU Vlinks and VLAN interfaces is not recommended.
To configure enhanced MAC VLAN for this example in the CLI:
config system interface edit npu0_vlink0.emacvlan1 set vdom VDOM1 set type emac-vlan set interface npu0_vlink0
next
edit npu0_vlink0.emacvlan2 set vdom VDOM3 set type emac-vlan set interface npu0_vlink0
next
edit npu0_vlink1.emacvlan1 set vdom VDOM2 set type emac-vlan set interface npu0_vlink1
next
end
Example 3: Enhanced MAC VLAN configuration for unique MAC addresses for each VLAN interface on the same physical port
Some networks require a unique MAC address for each VLAN interface when the VLAN interfaces share the same physical port. In this case, the enhanced MAC VLAN interface is used the same way as normal VLAN interfaces.
To configure this, use the set vlanid command for the VLAN tag.
To configure enhanced MAC VLAN for this example in the CLI:
config system interface edit interface-name set type emac-vlan set vlanid <VLAN-ID>
set interface <physical-interface>
end