Thank you for explaining it in a simple and effective way !! Also, please explain me the difference between H/W switch, S/W switch and VLAN switch in the Fortigate! Thank you!!
Watched this super tired didn't understand a thing... rested up watched again perfect sense you are a godsend! People who say Cisco cli is easier are nuts... Keep this going with these I'd request multi vlan network and dns most secure way
Great video. There’s an easier way. Just add all your VLANS/Subnets into a Zone (for example, an inside or trust zone), and disable “Block intra-zone traffic”, and they will all be able to communicate with each other without having to add any policies. Cheers
hhhh it's actually an animation software called Videoscribe, these icons are not buildin, I make them in Adobe illustrator & call them in videoscribe. Afterwards take a screenshot & paste in PowerPoint. That is what you see in the video
Thanks a lot,do I have to allow the vlan in the trunk linke or the native vlan is enough. I noticed in my Network the data vlan and voice are not mention in the trunk but sill pc can get an ip from the data vlan ,,How come don't I need to say switch port trunk allow vlan,x,y,z .
For a stateful firewall, I believe a single policy should be enough to facilitate to and fro traffic. Is it possible to do that in the FortiGate firewall as in Cisco ASA firewall?
Hello, Dr. Do you have any video related to ADVPN on Fortigate? It would be a great help, because of the amount of customers using this service nowadays. Regards.
I have all that setup with a Netgear smart managed switch. I can ping all vlans from a machine in VLan1 but I can't ping the machine on vlan 1 from the other vlans?
Well actually it depends, if you have a very small environment, then this approach is fine. If you're network is medium to large then YES, you need to separate via an L3 switch.
Can the ip address of the SVI be completely different from the main interface ip? For example, the main would be 192.168.1.99/24, then can a I use 30.30.25.1/24 for one of my SVI?
Sorry Jim your comment was in the spam of RU-vid, RU-vid blocks comments containing IP addresses i guess. Yes you can, the main interface will be as a native vlan with no vlan tag of course & the other SVI can be any Ip you want
Yeah but but you may need different policies for a set of vlans, you can actually create multiple zones referencing multiple vlans. The video is to give a concept that's why kept it simple. Obviously zones will be a better approach in the long term.