Fortinet 200D: how to implement VLAN, inter-VLAN routing, and DHCP relay?

Question

Here are the steps I configured so far:

General configuration steps

The following steps provide an overview of configuring and testing the hardware used in this example. For best results in this configuration, follow the procedures in the order given. Also, note that if you perform any additional actions between procedures, your configuration may have different results.

1. Configure the FortiGate unit
   • Configure the external interface
   • Add two VLAN subinterfaces to the internal network interface
   • Add firewall addresses and address ranges for the internal and external networks
   • Add security policies to allow: (this is technically for inter-vlan routing)
   • the VLAN networks to access each other
   • the VLAN networks to access the external network.
2. Configure the VLAN switch

Also created the trunk on the switch that connects to the LAN interface of the Fortinet, made a switchport access and assigned switchport access VLAN to it. Still not working as designed?

Answer 1

On the FGT this looks OK. However, you don't detail the config on the uplink switch nor its model.

It's essential that you mirror the FGT's VLAN configuration on the switch. An access switchport may not support multiple tagged VLANs - you need to configure a VLAN trunk with (at most) one VLAN untagged (native) and all others tagged.

My personal recommendation for the Fortigate is to run all VLANs tagged - this simplifies later changes and produces clean interface statistics (the physical interface for the untagged VLAN also counts tagged frames).