FortinetConfig923 downloads

Fortinet FortiGate Interface & VLAN Config

Physical interfaces, VLAN sub-interfaces, loopbacks, and aggregate (LACP) interface configuration for FortiGate firewalls.

↓ example.txt

What is it?

FortiGate interfaces are the entry points for all traffic. Physical interfaces connect directly to network links. VLAN sub-interfaces (type vlan) carry 802.1Q tagged traffic over a parent physical interface — used for inter-VLAN routing and DMZ segmentation. Aggregate interfaces (type aggregate) bond multiple physical ports using LACP for bandwidth and redundancy. Each interface has a 'role' (LAN, WAN, DMZ, undefined) that pre-populates FortiGate's GUI policies. The 'allowaccess' setting controls which management protocols are permitted on each interface.

When to use

·Adding new network segments (new VLAN for IoT devices, guest network, DMZ)
·Bonding two physical interfaces for uplink redundancy or throughput
·Replacing a router-on-a-stick setup — FortiGate does inter-VLAN routing natively

When NOT to use

·Do NOT set 'allowaccess https ssh' on WAN-facing interfaces — management access from the internet is a major security risk. Use a dedicated management interface or VPN for remote management.

How it compares

vs Cisco IOS interfacesIOS uses 'interface GigabitEthernet0/0.10' for sub-interfaces. FortiOS uses 'config system interface > edit vlan10 > set vlanid 10 > set interface port1'. Functionally identical, different syntax.

vs Palo Alto zonesPalo Alto separates 'interface' (Layer 3 config) from 'zone' (security policy membership). FortiGate assigns interface roles directly. Both approaches achieve the same segmentation.

Prerequisites

→Physical cabling must be completed before configuring interfaces
→VLANs must be trunked from the upstream switch before VLAN sub-interfaces will work
→For LACP aggregates: both ends (switch and FortiGate) must have LACP enabled before joining

Config Generator

Hostname *

Physical Interfaces

VLAN Sub-Interfaces

Aggregate (LACP) Interfaces

Verification commands

get system interface physical

Show physical link status, speed, and duplex for all interfaces

ExpectedLink status 'up', correct speed/duplex. 'down' means physical connectivity issue.

diagnose netlink interface list

Show detailed interface stats including TX/RX counters and errors

ExpectedNon-zero RX/TX packets for active interfaces. High error counts indicate hardware or cabling issues.

Debug commands

diagnose sys interface list

Show all interfaces with IP, MAC, and flags

Common mistakes & fixes

SymptomVLAN sub-interface not receiving traffic

CauseParent physical interface not configured as trunk on the upstream switch, or wrong VLAN ID

FixVerify switch port is in trunk mode with the VLAN allowed. Check VLAN ID matches exactly between FortiGate and switch.

SymptomAggregate interface members show 'individual' not 'aggregated'

CauseLACP not enabled on the switch side, or mismatched LACP mode (active vs passive)

FixSet switch port-channel to LACP active mode. Verify 'lacp-mode active' on FortiGate aggregate. Both sides must agree on active/passive.

Further learning

Recommended books to go deeper on this topic.

CCNA 200-301 Official Cert Guide Library

Wendell Odom · Cisco Press · Network interfaces, VLANs, routing — foundational knowledge for FortiGate

Kindle ↗Hardcover ↗

Network Security Architectures

Sean Convery · Cisco Press · Firewall interface design — DMZ, inside/outside, security zones

Hardcover ↗