Cisco3750 and Fortigate 60D Setup

[Charalampos Prevezanos]

Hello everyone,i would like your input on which way to go on the following task

Vlan10 Data

Vlan20 Voice

Vlan 30 Guest

Vlan 90 Management

I will post my switch config so you can see what i have done so far,and also take note that i have created all these vlans on the Fortigate witch their Dhcp using zones so i can have inter vlan communication.

Im confused,is this the right way to go or do the routing on the switch,also dhcp on the switch? 

And what is the correct way to go,im a newbie pls help :)

[Seb Rupik · Accepted solution]

Hi there,

If you require ACLs between your VLANs then it makes perfect sense to implement this on the Fortigate, this is made easier by its stateful inspection.

The only problem you may have is the 100Mb link to the Fortigate which you are using. You may find that the inter-VLAN traffic traveling up and down that single link will create congestion. If this occurs, either create and ether-channel between the switch and firewall or implement QoS to shape the traffic.

You other option if inter-VLAN security does not require extensive ACLs, move the routing to the 3750, use ACLs on the SVIs, and have a link point-to-point link to the Fortigate for internet/ DMZ traffic.

cheers,

Seb.

[Charalampos Prevezanos]

Thank you very much for your input,i want to go with Firewall solution and keep everything on it, i will be using a 100D because 60D does not support LACP for the 100 port issue you mentioned and you are right it will be a problem