FortiGate Administration Guide - FirewallShop.com

System Network
VLANs in Transparent mode
If the network uses IEEE 802.1 VLAN tags to segment your network traffic, you
can configure a FortiGate unit operating in Transparent mode to provide security
for network traffic passing between different VLANs. To support VLAN traffic in
Transparent mode, you add virtual domains to the FortiGate unit configuration. A
virtual domain consists of two or more VLAN subinterfaces or zones. In a virtual
domain, a zone can contain one or more VLAN subinterfaces.
When the FortiGate unit receives a VLAN tagged packet at an interface, the
packet is directed to the VLAN subinterface with matching VLAN ID. The VLAN
subinterface removes the VLAN tag and assigns a destination interface to the
packet based on its destination MAC address. The firewall policies for this source
and destination VLAN subinterface pair are applied to the packet. If the packet is
accepted by the firewall, the FortiGate unit forwards the packet to the destination
VLAN subinterface. The destination VLAN ID is added to the packet by the
FortiGate unit and the packet is sent to the VLAN trunk.
Note: There is a maximum of 255 interfaces total allowed per VDOM in Transparent mode.
This includes VLANs. If no other interfaces are configured for a VDOM, you can configure
up to 255 VLANs in that VDOM.
Figure 57: FortiGate unit with two virtual domains in Transparent mode
FortiGate unit
VLAN1
VLAN2
VLAN3
VLAN Switch
or router
Internal
VLAN1
VLAN2
VLAN3
VLAN
trunk
root virtual domain
VLAN1
VLAN1
New virtual domain
VLAN2
VLAN2
VLAN3
VLAN3
External
VLAN1
VLAN2
VLAN3
VLAN
trunk
VLAN Switch
or router
Internet
Figure 58 shows a FortiGate unit operating in Transparent mode and configured
with three VLAN subinterfaces. In this configuration the FortiGate unit could be
added to this network to provide virus scanning, web content filtering, and other
services to each VLAN.
FortiGate Version 3.0 MR5 Administration Guide
01-30005-0203-20070830 111