Wanted to get some advice and assurance that I’m on the right track for re-configuring our office network.
FortiGate100D with 2 physical network interfaces, network-1 used for regular LAN and office WiFi with subnet
192.168.0.1/24 using 3 UniFi APs which have a “guest” WiFi as well as office WiFi. The “guest” WiFi still has access to office servers and other computers (no isolation due to improper configuration?).
Network-1 has all the firewall rules on FortiGate; blocking social media access and other harmful/inappropriate sites, monitoring web traffics etc. We have multiple NAS along with 2 servers (files+web+DB), as well as 8+ printers.
DHCP, AD, DC is handled by one of the servers (Windows Server 2008 R2).
Network-2 used for Guest WiFi with subnet
10.10.10.1/24 has 2 UniFi APs with only 1 WiFi which has direct access to internet (DMZ). DHCP handled by FortiGate.
One particular Issue is
Network-2 UniFi APs use a separate controller than the one on
Network-1. Also we would like to give guest WiFi on
Network-1 full internet access (DMZ) and no access to internal network (servers, printers, NAS, etc.).
We also have 2 unused HP managed switches. Rest of the switches are unmanaged/basic switches.
What I’m planning is:
FortiGate100D 1 physical network with 3 VLANS:
with subnet192.168.0.1/24``` will be for wired LAN computers which have access to full network and have limited access to social media and inappropriate/harmful websites (same or similar firewall rules as Network-1).
VLAN 2 (maybe with
192.168.1.1/24?) will be for office devices using WiFi; they will have access to printers and servers but should not communicate with each other or
VLAN 3 will be for guest WiFi with full internet access (DMZ). Preferably separated network
220.127.116.11 or whichever is advisable.
Haven’t planned to use the HP managed switches yet but can should I need them. Will implement RADIUS Server in the future when we upgrade to Windows server 2016/2019.
Any issues or improvement to my planned setup?
How do I setup the VLAN on FortiGate, if that’s where I should be setting it up?
How do I setup a separate DHCP for
VLAN 3? And possible
VLAN 2is on separate DHCP/network how can it communicate with servers and printers on
Thanks and appreciate anything I can get. P.S: Just took over from the previous IT in charge