Virtual wire pair

A virtual wire pair consists of two interfaces that do not have IP addressing and are treated similar to a transparent mode VDOM. All traffic received by one interface in the virtual wire pair can only be forwarded out the other interface, provided that a virtual wire pair firewall policy allows this traffic. Traffic from other interfaces cannot be routed to the interfaces in a virtual wire pair. A virtual wire pair can include redundant and 802.3ad aggregate (LACP) interfaces.

Virtual wire pairs are useful for atypical topologies where MAC addresses do not behave normally. For example, port pairing can be used in a Direct Server Return (DSR) topology where the response MAC address pair may not match the request’s MAC address pair.

Virtual wire pairing replaces the port pairing feature available in earlier firmware versions. Unlike port pairing, virtual wire pairing can be used for FortiGates in both NAT and Transparent modes.

In the example configuration below, a virtual wire pair (consisting of port3 and port4) makes it easier to protect a web server that is behind a FortiGate operating as an Internal Segmentation Firewall (ISFW). Users on the internal network will access the web server through the ISFW over the virtual wire pair.

Adding a virtual wire pair and virtual wire pair policy

Interfaces used in a virtual wire pair cannot be used to access the ISFW FortiGate. Before creating a virtual wire pair, make sure you have a different port configured to allow admin access using your preferred protocol.

1. Go to Network > Interfaces and select Create New > Virtual Wire Pair.
2. Select the interfaces to add to the virtual wire pair. These interfaces cannot be part of a switch, such as the default lan/internal interface.
3. (Optional) If desired, enable Wildcard VLAN.
4. Select OK.
5. Go to Policy & Objects > IPv4 Virtual Wire Pair Policy, select the virtual wire pair, and select Create New.
6. Select the direction that traffic is allowed to flow.
7. Configure the other firewall options as desired.
8. Select OK.
9. If necessary, create a second virtual wire pair policy to allow traffic to flow in the opposite direction.

If you have a USB-wan interface, it will not be included in the interface list when building a wired-pair.

Results

Traffic can now flow through the FortiGate using the virtual wire pair.

For more information on this feature,see the Networking chapter.