Fortinet 200d has 8 internal (LAN) interfaces, but there is no way in the GUI to modify specific interface. For example: int1 of int2 on int3. They are all under one internal LAN interface. So, how would I apply different VLANs for different interfaces and route between them?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Jan 5, 2021 at 13:24

3 Answers 3


You can split the internal switch into individual ports. The way depends on your version of FortiOS. In v5.4 you can for instance pull a single port from the switch via the GUI (network 》interfaces 》lan). Below v5.4 set 'Config system global, set internall-interfacemode interface'

Note that you can only change a port if it is not referenced/used anywhere else - policy, DHCP server, addtess etc. You need to delete all references beforehand. That's why this usually is done right at the beginning of a configuration.

  • If I would leave VLAN's that I created under general "internal" interface which includes 8 interfaces, does this mean that VLAN's that I created applied to all 8 interfaces under "internal" interface? So, I can prug rg45 to any from the 8 interferes create the trunk int on the switch on other side and assign switchport with vlan on single switchport on the switch?
    – Nroot
    Mar 27, 2017 at 2:30
  • Yes, all 8 'internal' ports form a switch and act as one port. Mar 27, 2017 at 7:13
  • Alternatively, if all ports are already in a single hardware switch interface you can remove ports from it and create a new interface with one or more ports.
    – Zac67
    Jan 20, 2018 at 23:34

If you're using the GUI create a new (logical) interface of type hardware switch, add the physical interfaces to it and name it. If there aren't any physical ports available you'd need to remove them first from the logical interface they currently belong to.

Routing is activated by assigning IP addresses to the newly created interfaces and adding the appropriate firewall policy to allow traffic to be forwarded.


Instead of creating 8 saparate internal networks for 8 saparate interface .There is a feasible to create sub -interface for all the internal networks . To overcome bandwidth utilization on subinterface Configured link . Use 3 interface and aggregate the links

Further down stream switch Connecting firewall with trunk port allowing all Vlans .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.