Wanted to get some advice and assurance that I’m on the right track for re-configuring our office network.

Current setup:

FortiGate100D with 2 physical network interfaces, network-1 used for regular LAN and office WiFi with subnet using 3 UniFi APs which have a “guest” WiFi as well as office WiFi. The “guest” WiFi still has access to office servers and other computers (no isolation due to improper configuration?). Network-1 has all the firewall rules on FortiGate; blocking social media access and other harmful/inappropriate sites, monitoring web traffics etc. We have multiple NAS along with 2 servers (files+web+DB), as well as 8+ printers. DHCP, AD, DC is handled by one of the servers (Windows Server 2008 R2).

Network-2 used for Guest WiFi with subnet has 2 UniFi APs with only 1 WiFi which has direct access to internet (DMZ). DHCP handled by FortiGate.

One particular Issue is Network-2 UniFi APs use a separate controller than the one on Network-1. Also we would like to give guest WiFi on Network-1 full internet access (DMZ) and no access to internal network (servers, printers, NAS, etc.).

We also have 2 unused HP managed switches. Rest of the switches are unmanaged/basic switches.

What I’m planning is:

FortiGate100D 1 physical network with 3 VLANS:

``VLAN 1with subnet192.168.0.1/24``` will be for wired LAN computers which have access to full network and have limited access to social media and inappropriate/harmful websites (same or similar firewall rules as Network-1).

VLAN 2 (maybe with will be for office devices using WiFi; they will have access to printers and servers but should not communicate with each other or VLAN 3.

VLAN 3 will be for guest WiFi with full internet access (DMZ). Preferably separated network or whichever is advisable.

Haven’t planned to use the HP managed switches yet but can should I need them. Will implement RADIUS Server in the future when we upgrade to Windows server 2016/2019.

My questions:

  1. Any issues or improvement to my planned setup?

  2. How do I setup the VLAN on FortiGate, if that’s where I should be setting it up?

  3. How do I setup a separate DHCP for VLAN 3? And possible VLAN 2.

  4. If VLAN 2 is on separate DHCP/network how can it communicate with servers and printers on VLAN 1?

My Switch VLAN configuration- Switch VLANs

Thanks and appreciate anything I can get. P.S: Just took over from the previous IT in charge

1 Answer 1


Any issues or improvement to my planned setup?

Looks OK to me. Note that your "VLANs" are more like different security zones. VLANs can be used to run those zones over the same hardware, instead of using separate hardware.

How do I setup the VLAN on FortiGate, if that’s where I should be setting it up?

VLANs are used when a single link is used to connect multiple L2 segments - a VLAN trunk. The Ethernet frames are tagged according to their VLAN association, so the receiving side knows where they go.

Unmanaged switches don't support VLANs, so if you want to go with those you just set a dedicated interface (or switch group) on the Fortigate for each zone and you're good to go.

If you plan to use the managed switches you can use VLANs on both sides, so you only need a single link for everything. On the Fortigate's GUI, that is done in Network -> Interfaces -> Create New -> Interface -> Type VLAN. On the switch interface towards the Fortigate, you need to replicate the VLAN setup - same VLAN IDs, same tagging. The access/client ports need to be untagged for the desired VLAN, no tagged VLANs.

Of course, the Fortigate needs an IP interface in each zone/VLAN and needs to be used as the default gateway.

How do I setup a separate DHCP for VLAN 3? And possible VLAN 2.

Since you've already got a DHCP server, set up new a scope for each VLAN. You could connect the DHCP server to each VLAN directly (deactivate the file service for the guest VLAN), possibly using a VLAN trunk to the server. A better option is to set up DHCP relay on the Fortigate (Network -> Interfaces -> Edit Interface -> Activate DHCP server -> Advanced -> Mode: Relay).

If VLAN 2 is on sepearte DHCP/network how can it communicate with servers and printers on VLAN 1?

Routers route between VLANs. The Fortigate has a deny all default rule, so you need to explictly allow devices on VLAN 2 to communicate with VLAN 1. For VLAN 3, you just allow any traffic out of the WAN interface so these can't talk to VLAN 1.

  • Sorry, need to clarify DHCP is on the FortiGate and also the 2 managed HP switches are being used in the current setup. Made a VLAN (VLAN 10) with DHCP Server on the FortiGate on my Network-1, did the same on the HP Switches and Tagged all ports with it. Then I created a Guest WiFi with the same VLAN and it works on the APs connected directly to FortiGate but not on the ones connected to the switches..I get these alerts every minute in the controller "AP1 is unable to reach the DHCP server for VLAN 10"
    – Doc
    Commented Aug 10, 2019 at 16:04
  • Added A Picture of my Switch VLANS
    – Doc
    Commented Aug 10, 2019 at 16:10
  • My issue is probably the unmanaged switch in between. Thanks for your help with everything else, got the assurity I needed!
    – Doc
    Commented Aug 10, 2019 at 20:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.