Configuring VLANs

Use Virtual Local Area Networks (VLANs) to logically separate a LAN into smaller broadcast domains. VLANs allow you to define different policies for different types of users and to set finer control on the LAN traffic. (Traffic is only sent automatically within the VLAN. You must configure routing for traffic between VLANs.)

From the FortiGate unit, you can centrally configure and manage VLANs for the managed FortiSwitch units.

In FortiSwitchOS 3.3.0 and later releases, the FortiSwitch supports untagged and tagged frames in FortiLink mode. The switch supports up to 1,023 user-defined VLANs. You can assign a VLAN number (ranging from 1-4095) to each of the VLANs. For FortiSwitch units in FortiLink mode (FortiOS 6.2.0 and later), you can assign a name to each VLAN.

You can configure the default VLAN for each FortiSwitch port as well as a set of allowed VLANs for each FortiSwitch port.

This section covers the following topics:

• Creating VLANs
• Viewing FortiSwitch VLANs
• Changing the VLAN configuration mode

Creating VLANs

Setting up a VLAN requires you to create the VLAN and assign FortiSwitch ports to the VLAN. You can do this with either the Web GUI or CLI.

Using the GUI

To create the VLAN:

1. Go to WiFi & Switch Controller > FortiSwitch VLANs, select Create New, and change the following settings:

   Interface Name	VLAN name
   VLAN ID	Enter a number (1-4094)
   Color	Choose a unique color for each VLAN, for ease of visual display.
   Role	Select LAN, WAN, DMZ, or Undefined.

2. Enable DHCP for IPv4 or IPv6.
3. Set the Administrative access options as required.
4. Select OK.

To assign FortiSwitch ports to the VLAN:

1. Go to WiFi & Switch Controller > FortiSwitch Ports.
2. Click a port row.
3. Click the Native VLAN column in one of the selected entries to change the native VLAN.
4. Select a VLAN from the displayed list. The new value is assigned to the selected ports.
5. Click the + icon in the Allowed VLANs column to change the allowed VLANs.
6. Select one or more of the VLANs (or the value all) from the displayed list. The new value is assigned to the selected port.

Using the FortiSwitch CLI

1. Create the marketing VLAN.

   config system interface

   edit <vlan name>

   set vlanid <1-4094>

   set color <1-32>

   set interface <FortiLink-enabled interface>

   end

2. Set the VLAN’s IP address.

   config system interface

   edit <vlan name>

   set ip <IP address> <Network mask>

   end

3. Enable a DHCP Server.

   config system dhcp server

   edit 1

   set default-gateway <IP address>

   set dns-service default

   set interface <vlan name>

   config ip-range

   set start-ip <IP address>

   set end-ip <IP address>

   end

   set netmask <Network mask>

   end

4. Assign ports to the VLAN.

   config switch-controller managed-switch

   edit <Switch ID>

   config ports

   edit <port name>

   set vlan <vlan name>

   set allowed-vlans <vlan name>

   or

   set allowed-vlans-all enable

   next

   end

   end

5. Assign untagged VLANs to a managed FortiSwitch port:

   config switch-controller managed-switch

   edit <managed-switch>

   config ports

   edit <port>

   set untagged-vlans <VLAN-name>

   next

   end

   next

   end

Viewing FortiSwitch VLANs

The WiFi & Switch Controller > FortiSwitch VLANs page displays VLAN information for the managed switches.

Each entry in the VLAN list displays the following information:

• Name—name of the VLAN
• VLAN ID—the VLAN number
• IP/Netmask—address and mask of the subnetwork that corresponds to this VLAN
• Access—administrative access settings for the VLAN
• Ref—number of configuration objects referencing this VLAN

Changing the VLAN configuration mode

You can change which VLANs the set allowed-vlans command affects.

If you want the set allowed-vlans command to apply to all user-defined VLANs, use the following CLI commands:

config switch-controller global

set vlan-all-mode defined

end

If you want the set allowed-vlans command to apply to all possible VLANs (1-4094), use the following CLI commands:

config switch-controller global

set vlan-all-mode all

end

NOTE: You cannot use the set vlan-all-mode all command with the set vlan-optimization enable command.