1. Yes the Primary vlan is the entity that homes the shared subnet for community and isolated vlans. Why would each switch have their own Primary vlan address? (Is your switch management vlan the same vlan as the Primary vlan?)

Thus I imagine your core switch is performing MLS(Multi-Layer Switching) and homes the Primary Vlan SVI unless your fortinet is the gateway?

2. You don't need to define three different isolated vlans. The purpose of the isolated vlan is to only allow communication between an isolated port and promiscuous port. By definition the isolated host will not be able to communicate with any other type of port other than the promiscuous port. Just trunk one isolated vlan through the pvlan domain and utilize it.

Another note is that a Primary Vlan can be associated with at most one isolated vlan and many community vlans. Likewise a Promiscuous port can only served one primary vlan, one isolated vlan and many community vlans.

3. Why do you need to trunk the vlans through to your fortinet firewall? If it isn't absolutely necessary I'd turn this into a routed link between the core switch and the fortinet. If your core switch is L3 capable.

4. Just use a Promiscuous-PVlan trunk for the link to devices that don't support PVLAN or protected ports. This will ensure secondary vlan tagged frames are rewritten with the primary vlan tag when crossing the trunk. Although if you make 3) happen then this may not be necessary anymore AIUI.

HTH. Feel free to ask for clarification.

1. Yes the Primary vlan is the entity that homes the shared subnet for community and isolated vlans. Why would each switch have their own Primary vlan address? (Is your switch management vlan the same vlan as the Primary vlan?)

Thus I imagine your core switch is performing MLS(Multi-Layer Switching) and homes the Primary Vlan SVI?

2. You don't need to define three different isolated vlans. The purpose of the isolated vlan is to only allow communication between an isolated port and promiscuous port. By definition the isolated host will not be able to communicate with any other type of port other than the promiscuous port. Just trunk one isolated vlan through the pvlan domain and utilize it.

Another note is that a Primary Vlan can be associated with at most one isolated vlan and many community vlans. Likewise a Promiscuous port can only served one primary vlan, one isolated vlan and many community vlans.

3. Why do you need to trunk the vlans through to your fortinet firewall? If it isn't absolutely necessary I'd turn this into a routed link between the core switch and the fortinet. If your core switch is L3 capable.

4. Just use a Promiscuous-PVlan trunk for the link to devices that don't support PVLAN or protected ports. This will ensure secondary vlan tagged frames are rewritten with the primary vlan tag when crossing the trunk. Although if you make 3) happen then this may not be necessary anymore AIUI.

HTH. Feel free to ask for clarification.