1

I have a scenario in a client that a couple of ISPs directly connect to the fortiswitches behind the fortigates firewalls instead of connecting to the fortigates or any switches before the fortigate firewalls. As far as I know, the typical network architecture is to separate the internet and corporate network by DMZ or at least a firewall.

However, someone told me that this is okay since the traffic is still under control of the Fortigate firewall which I do not quite understand. What if the fortiswitches route traffic to public directly and not go through the firewalls? Does the fortigate know all of the traffic even if it is not going through them?

Any clarification or explanation would be appreciated.

Improve this question

2 Answers 2

Reset to default
0

You would have to provide the configuration details for any kind of actual reliable answer but the situation you describe is entirely possible and viable assuming the use of VLAN configuration on the switches to keep the internet connections isolated from the internal/protected networks on the 'inside' of the firewalls.

Improve this answer
2
  • Thanks. Yes. We do have vlan setup. But I am really interested about how could the firewalls take the access control to "keep the internet connections isolated from the internal/protected networks on the 'inside' of the firewalls". Correct me if I am wrong. The vlan segmentation is done by the switch and how does the firewall monitor the traffic in this scenario if the egress traffic does not go through the firewall? I am new to network. Please advice any articles or books.
    – Rich
    Mar 19 at 16:51
  • It does go through the firewall. You segment a couple of ports on the switch for the internet connection and the firewall WAN interface to connect to. The rest of the ports are configured with a VLAN for the inside connection of the firewall and inside systems. Traffic goes through the firewall as usual.
    – FrameHowitzer
    Mar 20 at 19:41
0

I think you rather mean the ISP connections run through switches before getting to the firewalls, is that normal?

Yes, it is. You can run the ISP handover ports through a managed switch using a dedicated VLAN that the firewalls are connected to. Purposes include connecting multiple (HA) firewalls to a single handover port, physically relocating that port and monitoring/tracing.

Of course, you'd need to make sure that there's no outside influence on the switches - configure no IP address on the VLAN for the switch, filter STP BPDUs or at least disable TCNs, enable root guard, also disable LLDP, ICMP notifications, and so on. Properly configured, there's no attack surface for a hacker and no security risk.

Improve this answer
2
  • But what if the same switch is serving as one of the main switches for corporate network with downstream swtiches and direct devices or computers connected to it? And what is the purpose of this kind of connectivity. Besides, in this case what is the firewall used for? Thanks so much.
    – Rich
    Mar 19 at 16:40
  • I've added details to the answer.
    – Zac67 ♦
    Mar 19 at 16:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.