Wanted to get some advice and assurance that I’m on the right track for re-configuring our office network.
Current setup:
FortiGate100D with 2 physical network interfaces, network-1 used for regular LAN and office WiFi with subnet 192.168.0.1/24
using 3 UniFi APs which have a “guest” WiFi as well as office WiFi. The “guest” WiFi still has access to office servers and other computers (no isolation due to improper configuration?). Network-1
has all the firewall rules on FortiGate; blocking social media access and other harmful/inappropriate sites, monitoring web traffics etc. We have multiple NAS along with 2 servers (files+web+DB), as well as 8+ printers.
DHCP, AD, DC is handled by one of the servers (Windows Server 2008 R2).
Network-2
used for Guest WiFi with subnet 10.10.10.1/24
has 2 UniFi APs with only 1 WiFi which has direct access to internet (DMZ). DHCP handled by FortiGate.
One particular Issue is Network-2
UniFi APs use a separate controller than the one on Network-1
. Also we would like to give guest WiFi on Network-1
full internet access (DMZ) and no access to internal network (servers, printers, NAS, etc.).
We also have 2 unused HP managed switches. Rest of the switches are unmanaged/basic switches.
What I’m planning is:
FortiGate100D 1 physical network with 3 VLANS:
``VLAN 1with subnet
192.168.0.1/24``` will be for wired LAN computers which have access to full network and have limited access to social media and inappropriate/harmful websites (same or similar firewall rules as Network-1).
VLAN 2
(maybe with 192.168.1.1/24
?) will be for office devices using WiFi; they will have access to printers and servers but should not communicate with each other or VLAN 3
.
VLAN 3
will be for guest WiFi with full internet access (DMZ). Preferably separated network 172.168.1.1
or whichever is advisable.
Haven’t planned to use the HP managed switches yet but can should I need them. Will implement RADIUS Server in the future when we upgrade to Windows server 2016/2019.
My questions:
Any issues or improvement to my planned setup?
How do I setup the VLAN on FortiGate, if that’s where I should be setting it up?
How do I setup a separate DHCP for
VLAN 3
? And possibleVLAN 2
.If
VLAN 2
is on separate DHCP/network how can it communicate with servers and printers onVLAN 1
?
Thanks and appreciate anything I can get. P.S: Just took over from the previous IT in charge