Restructuring office network advice and How to go about VLAN setup?

Question

Wanted to get some advice and assurance that I’m on the right track for re-configuring our office network.

Current setup:

FortiGate100D with 2 physical network interfaces, network-1 used for regular LAN and office WiFi with subnet 192.168.0.1/24 using 3 UniFi APs which have a “guest” WiFi as well as office WiFi. The “guest” WiFi still has access to office servers and other computers (no isolation due to improper configuration?). Network-1 has all the firewall rules on FortiGate; blocking social media access and other harmful/inappropriate sites, monitoring web traffics etc. We have multiple NAS along with 2 servers (files+web+DB), as well as 8+ printers. DHCP, AD, DC is handled by one of the servers (Windows Server 2008 R2).

Network-2 used for Guest WiFi with subnet 10.10.10.1/24 has 2 UniFi APs with only 1 WiFi which has direct access to internet (DMZ). DHCP handled by FortiGate.

One particular Issue is Network-2 UniFi APs use a separate controller than the one on Network-1. Also we would like to give guest WiFi on Network-1 full internet access (DMZ) and no access to internal network (servers, printers, NAS, etc.).

We also have 2 unused HP managed switches. Rest of the switches are unmanaged/basic switches.

What I’m planning is:

FortiGate100D 1 physical network with 3 VLANS:

``VLAN 1with subnet192.168.0.1/24``` will be for wired LAN computers which have access to full network and have limited access to social media and inappropriate/harmful websites (same or similar firewall rules as Network-1).

VLAN 2 (maybe with 192.168.1.1/24?) will be for office devices using WiFi; they will have access to printers and servers but should not communicate with each other or VLAN 3.

VLAN 3 will be for guest WiFi with full internet access (DMZ). Preferably separated network 172.168.1.1 or whichever is advisable.

Haven’t planned to use the HP managed switches yet but can should I need them. Will implement RADIUS Server in the future when we upgrade to Windows server 2016/2019.

My questions:

1. Any issues or improvement to my planned setup?

2. How do I setup the VLAN on FortiGate, if that’s where I should be setting it up?

3. How do I setup a separate DHCP for VLAN 3? And possible VLAN 2.

4. If VLAN 2 is on separate DHCP/network how can it communicate with servers and printers on VLAN 1?

My Switch VLAN configuration-

Thanks and appreciate anything I can get. P.S: Just took over from the previous IT in charge

Answer 1

Any issues or improvement to my planned setup?

Looks OK to me. Note that your "VLANs" are more like different security zones. VLANs can be used to run those zones over the same hardware, instead of using separate hardware.

How do I setup the VLAN on FortiGate, if that’s where I should be setting it up?

VLANs are used when a single link is used to connect multiple L2 segments - a VLAN trunk. The Ethernet frames are tagged according to their VLAN association, so the receiving side knows where they go.

Unmanaged switches don't support VLANs, so if you want to go with those you just set a dedicated interface (or switch group) on the Fortigate for each zone and you're good to go.

If you plan to use the managed switches you can use VLANs on both sides, so you only need a single link for everything. On the Fortigate's GUI, that is done in Network -> Interfaces -> Create New -> Interface -> Type VLAN. On the switch interface towards the Fortigate, you need to replicate the VLAN setup - same VLAN IDs, same tagging. The access/client ports need to be untagged for the desired VLAN, no tagged VLANs.

Of course, the Fortigate needs an IP interface in each zone/VLAN and needs to be used as the default gateway.

How do I setup a separate DHCP for VLAN 3? And possible VLAN 2.

Since you've already got a DHCP server, set up new a scope for each VLAN. You could connect the DHCP server to each VLAN directly (deactivate the file service for the guest VLAN), possibly using a VLAN trunk to the server. A better option is to set up DHCP relay on the Fortigate (Network -> Interfaces -> Edit Interface -> Activate DHCP server -> Advanced -> Mode: Relay).

If VLAN 2 is on sepearte DHCP/network how can it communicate with servers and printers on VLAN 1?

Routers route between VLANs. The Fortigate has a deny all default rule, so you need to explictly allow devices on VLAN 2 to communicate with VLAN 1. For VLAN 3, you just allow any traffic out of the WAN interface so these can't talk to VLAN 1.