Fortinet fortigate-200a Betriebsanweisung

In NAT/Route mode, the FortiGate units support VLANs for constructing VLAN trunks 
between an IEEE 802.1Q-compliant switch (or router) and the FortiGate unit. Normally 
the FortiGate unit internal interface connects to a VLAN trunk on an internal switch, 
and the external interface connects to an upstream Internet router untagged. The 
FortiGate unit can then apply different policies for traffic on each VLAN that connects 
to the internal interface.

In this configuration, you add VLAN subinterfaces to the FortiGate internal interface 
that have VLAN IDs that match the VLAN IDs of packets in the VLAN trunk. The 
FortiGate unit directs packets with VLAN IDs, to subinterfaces with matching VLAN 
IDs.

You can also define VLAN subinterfaces on all FortiGate interfaces. The FortiGate 
unit can add VLAN tags to packets leaving a VLAN subinterface or remove VLAN tags 
from incoming packets and add a different VLAN tags to outgoing packets.

In NAT/Route mode, two VLAN subinterfaces added to the same physical interface 
cannot have the same VLAN ID. However, you can add two or more VLAN 
subinterfaces with the same VLAN IDs to different physical interfaces. There is no 
internal connection or link between two VLAN subinterfaces with same VLAN ID. Their 
relationship is the same as the relationship between any two FortiGate network 
interfaces.

IP addresses of all FortiGate interfaces cannot overlap. That is, the IP addresses of all 
interfaces must be on different subnets. This rule applies to both physical interfaces 
and to VLAN subinterfaces.

 shows a simplified NAT/Route mode VLAN configuration. In this example, 

FortiGate internal interface connects to a VLAN switch using an 802.1Q trunk and is 
configured with two VLAN subinterfaces (VLAN 100 and VLAN 200). The external 
interface connects to the Internet. The external interface is not configured with VLAN 
subinterfaces. 

When the VLAN switch receives packets from VLAN 100 and VLAN 200, it applies 
VLAN tags and forwards the packets to local ports and across the trunk to the 
FortiGate unit. The FortiGate unit is configured with policies that allow traffic to flow 
between the VLANs and from the VLANs to the external network.

Note: If you are unable to change your existing configurations to prevent IP overlap, enter the 
CLI command config system global and set ip-overlap enable to allow IP address 
overlap. If you enter this command, multiple VLAN interfaces can have an IP address that is 
part of a subnet used by another interface. This command is recommended for advanced users 
only.