Layer3 Switch - Firewall on a stick

[Mathijs-Aartsen]

I have a catalyst 9300 as L3 switch and a Fortinet Firewall.

I have multiple L3 vlan interfaces on the switch, and therefore shows their subnets as CONNECTED in the router table.
I would love to have the full power of the fortigate between the 2 vlans for firewalling, is there a way to send traffic to the firewall and have it send it back down?

[MHM Cisco World]

Yes config DHCP to send FW IP to client to use it as GW, 
config FW with static route to forward traffic to SW 
this make traffic go to FW inspect and then return to L3 SW

[Richard Burts]

Am I correct in assuming that your firewall has a single IP address on its connection to your 9300? And is the connection from the 9300 to the firewall a routed link (subnet different from the subnets of the vlans)? In that case using the firewall as the gateway is going to be problematic.

I think that a better alternative would be to make your 9300 a L2 device and to trunk both vlans from the 9300 to the firewall (and configure the firewall to recognize and process both of the vlans).

[balaji.bandi]

I would love to have the full power of the fortigate between the 2 vlans for firewalling, is there a way to send traffic to the firewall and have it send it back down?

This require more information for us to understand, if you looking 2 VLAN to be Firewall, then Make Fortigate as Gateway for the VLAN, so traffic VLAN X to VLAN Y will pass through the FW, so you can have allow or deny rule based on the requirement.

is this what you looking to achieve ?

[KJK99]

I think Mr MHM Cisco World is right on how to implement it. However, is it really a good idea to mess up a clean configuration just for the sake of “I would love to have the full power of the fortigate between the 2 vlans for firewalling?”

[Mathijs-Aartsen · Accepted solution]

I found an accepted solution.

The C9300 has a routed link to the fortigate.

Now i have all vlan's terminated in the C9300 with SVI's.
Then i have a policy based route to the fortigate configured for IN on the svi's

The fortigate IP is also checked for availability, so if it's down the routing from the C9300 will take over.

[Richard Burts]

Thanks for the update. The key thing is that 9300 to fortunate is a routed link. PBR is a good solution for that environment. Glad to know that your solution is working.