Transcription
Hello friend.
Welcome to my video. This video describes the steps to create VLAN on a FortiGate Firewall and Cisco switch. In this model, I divide the network into 2 VLANs: VLAN 10 and VLAN 20.
These 2 VLANs, 10 and 20, have been configured with subinterfaces on Port 2 of FortiGate to be divided among departments. Clients of VLAN 10 and 20 use dynamic IP, so we configure more DHCP Scope to grant clients. Port 1 is connected to the Internet.
Go to System -> Network and select 'Create New'. Select Interface. Create the VLAN interface for VLAN ID 10 and enable DHCP Server. Give a name to the VLAN interface. Choose the physical interface on which to attach the VLAN. Here is Port 2. Select 'Type' as VLAN. Give a desired VLAN ID. Here is 10. Configure DHCP scope to provide IP addresses to clients.
Go to System -> Network, expand the physical port, and the VLAN will be displayed.
Now, for a similar configuration for VLAN 20. Go to System -> Network and select 'Create New'. Select 'Interface'. Create the VLAN interface for VLAN ID 20 and enable DHCP Server. Here is 20. Configure DHCP scope to provide IP addresses to clients.
Go to System -> Network, expand the physical port, and the VLAN will be displayed.
Configure the default route at Static Routes. Set the Destination IP or Mask to 0.0.0.0 and 0.0.0.0, the Device to the Internet-facing interface, and Gateway is the IP address of the ISP's router.
Create a Policy that allows VLANs to access the Internet. Configure firewall policy for VLAN ID 10. Go to Policy and Objects -> Firewall Policy and select 'Create New'. Give a Name for the policy. Set the Incoming Interface to VLAN 10 and the Outgoing Interface to the Internet-facing interface.
Incoming Interface: VLAN 10. Outgoing Interface: WAN 1. Set Source, Destination Address, Schedule, and Services to ALL. Make sure the Action is set to ACCEPT. Turn on NAT and make sure Use Outgoing Interface Address is selected.
Now, configure firewall policy for VLAN ID 20. Give a Name for the policy. Set the Incoming Interface to VLAN 20 and the Outgoing Interface to the Internet-facing interface.
Incoming Interface: VLAN 20. Outgoing Interface: WAN 1. Set Source, Destination Address, Schedule, and Services to ALL. Make sure the Action is set to ACCEPT. Turn on NAT and make sure Use Outgoing Interface Address is selected.
In this section, configure VLAN 10 and VLAN 20 on Cisco switches with corresponding ports.
In Switch Core, configure terminal. Interface 0/0: switchport mode trunk, encapsulation dot1q, switchport mode trunk, switchport trunk allowed VLAN 10, 20. Exit.
Interface 0/2: switchport mode trunk, encapsulation dot1q, switchport trunk allowed VLAN 10.
In Switch Access 1, interface 0/0: switchport mode trunk, encapsulation dot1q, switchport trunk allowed VLAN 10.
Interface 0/3: switchport mode access, switchport access VLAN 10.
You can now browse the Internet using a computer connected to VLAN 10.
You can now browse the Internet using a computer connected to VLAN 10.
You configure the same with VLAN 20.
In Switch Core, configure terminal. Interface 0/3: switchport mode trunk, encapsulation dot1q, switchport mode trunk, switchport trunk allowed VLAN 20. Exit.
In Switch Access 2, configure terminal. Interface 0/0: switchport mode trunk, encapsulation dot1q, switchport trunk allowed VLAN 20. Exit.
Interface 0/3: switchport mode access, switchport access VLAN 20. Exit.
You can now browse the Internet using a computer connected to VLAN 20.
You can now browse the Internet using a computer connected to VLAN 20.
You can now browse the Internet using a computer connected to VLAN 20.
Next, create a Policy that allows VLANs to communicate with each other. VLANs that communicate with each other must create corresponding 2-way policies.
Go to Policy and Objects -> Firewall Policy and select 'Create New'. Give a Name for the policy. Set the Incoming Interface to VLAN 10 and the Outgoing to VLAN 20.
Incoming Interface: VLAN 10. Outgoing Interface: VLAN 20. Set Source, Destination Address, Schedule, and Services to ALL.
Set Source, Destination Address, Schedule, and Services to ALL.
Set Source, Destination Address, Schedule, and Services to ALL.
Set Source, Destination Address, Schedule, and Services to ALL.
Make sure the Action is set to ACCEPT. Turn off NAT.
Give a Name for the policy. Set the Incoming Interface to VLAN 20 and the Outgoing to VLAN 10.
Incoming Interface: VLAN 20. Outgoing Interface: VLAN 10. Set Source, Destination Address, Schedule, and Services to ALL.
Set Source, Destination Address, Schedule, and Services to ALL.
Set Source, Destination Address, Schedule, and Services to ALL.
Make sure the Action is set to ACCEPT. Turn off NAT.
Now, computers belonging to 2 different VLANs can communicate with each other and browse the Internet.
I hope this video helped you create VLAN on a FortiGate and Cisco switch.
As always, if you found this post useful, subscribe to my YouTube channel.