Fortinet – Creating vlans for devices directly connected to device
April 12, 2016
Posted by on
The other day I had the need to plug a Ruckus Access point directly into the Fortigate firewall. The client only needed 1 AP, and connecting directly into one of the ports on the Fortigate was the best way – PoE was provided by an injector.
The question came up of how to create the Vlan interface when directly connecting the device to Fortigate.
In this example I will create the vlan on the Internal switch “lan”, and control the vlan from the Ruckus Zonedirector. This will create two separate logical interfaces. Internal, and Staff-Wireless, my newly created vlan. These two interfaces will require IPV4 policies to allow communication. If you have a lot of VLANs it might be a great idea to utilize Zones in the FW to reduce the number of firewall policies needed.
Lets get started
Vlan creation of Fortigate
So, lets create the vlan for “Staff-Wifi” Vlan 200. You can just create
Now lets put in the needed info.
The below shows the status of the interface:
Notice the VLAN ID – this is seen by right clicking the column settings and enabling that.
Thats it! The Ruckus AP will tag “Staff-Wireless” traffic as vlan 200. So, when the FGT sees the vlan tag of 200 on any ports in the lan switch, it will be treated as Staff-Wifi, thus getting all of its network and policies.
To make the AP work correctly, it needs to be plugged directly into the FGT or a switch behind the FGT that has the vlan created and that vlan would need to be tagged on both the AP and uplink to Fortigate.
Below shows the advanced options of my Ruckus ZD. I am tagging the Staff-Wifi SSID as vlan 200.
Remember on the Ruckus side only vlan 200 is being tagged for Staff-wifi AP management traffic is untagged – so it would be on my “LAN” switch network.