---
title: "Configure VLAN"
sidebar_label: "Configure VLAN"
sidebar_position: 8
description: "How to create two VLANs with access to each other and the internet"
---

import Formbricks from '@theme/MDXComponents/Formbricks';

import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';
import { TabItemLabel } from '@selectel/docux/components';

# Configure VLAN

Virtual Local Area Networks (VLANs) allow you to segment a network, increase performance, and provide additional network security.

The settings in this guide are relevant for FortiOS versions 6.x and 7.x. If you have a different version of FortiOS, you can find the documentation for it in the FortiGate control panel in the upper right corner or on the [official FortiGate website](https://docs.fortinet.com).

To create two virtual networks with access to each other and the internet:

1. [Create network interfaces](#create-interfaces).
2. [Configure the security policy](#configure-security-policy).

## Create network interfaces \{#create-interfaces}

<Tabs queryString="create-interfaces">
  <TabItem value="graphic" default>
    <TabItemLabel>
      Graphical interface
    </TabItemLabel>

    <Tabs queryString="create-interfaces">
      <TabItem value="fortios-6" default>
        <TabItemLabel>
          FortiOS 6.x
        </TabItemLabel>

        1. [Connect to the firewall](firewalls/fortigate/connect-to-firewall.mdx).

        2. Go to the **Network** → **Interfaces** tab.

        3. Specify the interface name.

        4. In the **Type** field, select — VLAN.

        5. In the **VLAN ID** field, specify the network identifier.

        6. In the **Role** field, select — LAN.

        7. In the **IP/Netmask** field, specify the IP address and subnet mask for the VLAN.

        8. Click **OK**.

        9. Repeat steps 1—8 to create the second network interface.

        10. Go to the **Policy & Objects** → **Addresses** section.

        11. Click **Create new**.
      </TabItem>

      <TabItem value="fortios-7-6">
        <TabItemLabel>
          FortiOS 7.x
        </TabItemLabel>

        1. [Connect to the firewall](firewalls/fortigate/connect-to-firewall.mdx).

        2. Go to the **Network** → **Interfaces** tab.

        3. Select **Create New** → **Interface**.

        4. Specify the interface name.

        5. In the **Type** field, select — VLAN.

        6. Specify the network identifier in the **VLAN ID** field.

        7. In the **Role** field, select — LAN.

        8. In the **IP/Netmask** field, specify the IP address and subnet mask.

        9. Enable **Create address object matching subnet**. An address for the VLAN will be automatically created in the **Policy & Objects** → **Addresses** section.

        10. Repeat steps 1–9 to create the second network interface.
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="cli">
    <TabItemLabel>
      CLI
    </TabItemLabel>

    1. [Connect to the firewall](firewalls/fortigate/connect-to-firewall.mdx).

    2. Create two interfaces:

       ```bash
       config system interface
            edit "<vlan_name_1>"
                set vdom root
                set ip <ip_address_1> <mask_1>
                set allowaccess ping https ssh
                set role lan
                set interface lan
                set vlanid <vlan_id_1>
            next
            edit "<vlan_name_2>"
                set vdom root
                set ip <ip_address_2> <mask_2>
                set allowaccess ping https ssh
                set role lan
                set interface lan
                set vlanid <vlan_id_2>
       end
       ```

       Specify:

       * `<vlan_name_1>` — the name of the first network interface;
       * `<ip_address_1>` — the IP address to be assigned to the first interface;
       * `<mask_1>` — subnet mask for the first interface, e.g., `255.255.255.0`;
       * `<vlan_id_1>` — the identifier of the first interface;
       * `<vlan_name_2>` — the name of the second interface;
       * `<ip_address_2>` — the IP address to be assigned to the second interface;
       * `<mask_2>` — subnet mask for the second interface, e.g., `255.255.255.0`;
       * `<vlan_id_2>` — the identifier of the second VLAN.

    3. Add two addresses for the created VLANs:

       ```bash
       config firewall address
           edit <vlan_address_1>
               set type ipmask
               set subnet <ip_address_1> <mask_1>
           next
           edit <vlan_address_2>
               set type ipmask
               set subnet <ip_address_2> <mask_2>
        end
       ```

       Specify:

       * `<vlan_address_1>` — the name of the IP address assigned to the first VLAN;
       * `<ip_address_1>` — the IP address assigned to the first VLAN;
       * `<mask_1>` — the subnet mask of the first VLAN;
       * `<vlan_address_2>` — the name of the IP address assigned to the second VLAN;
       * `<ip_address_2>` — the IP address assigned to the second VLAN;
       * `<mask_2>` — the subnet mask of the second VLAN.
  </TabItem>
</Tabs>

## Configure the security policy \{#configure-security-policy}

<Tabs queryString="configure-security-policy">
  <TabItem value="graphic" default>
    <TabItemLabel>
      Graphical interface
    </TabItemLabel>

    1. Go to the **Policy & Objects** → **IPv4 Policy** section and create a new policy.

    2. In the **Incoming Interface** field, select the first VLAN.

    3. In the **Outgoing Interface** field, select the second VLAN.

    4. In the **Source** field, select the address of the first VLAN.

    5. In the **Destination** field, select the address of the second VLAN.

    6. Make sure that NAT is disabled in the policy.

    7. Repeat steps 1–6 to create the second policy. In this policy, swap the first and second VLANs.

    8. Go to the **Policy & Objects** → **IPv4 Policy** section and create a new policy.

    9. In **Incoming Interface**, select the first VLAN.

    10. In **Outgoing Interface**, select the external interface.

    11. In **Source**, select the address of the first VLAN.

    12. In **Destination**, select the address of the external interface.

    13. Repeat steps 8–12 to create a policy for the second VLAN.
  </TabItem>

  <TabItem value="cli">
    <TabItemLabel>
      CLI
    </TabItemLabel>

    1. Create a new policy:

       ```bash
       config firewall policy
           edit 3
               set name "<vlan_name_1> to <vlan_name_2>"
               set srcintf "<vlan_name_1>"
               set dstintf "<vlan_name_2>"
               set srcaddr "<vlan_address_1>"
               set dstaddr "<vlan_address_2>"
               set action accept
               set schedule "always"
               set service "ALL"
               set nat disable
           next
           edit 4
               set name "<vlan_name_2> to <vlan_name_1>"
               set srcintf "<vlan_name_2>"
               set dstintf "<vlan_name_1>"
               set srcaddr "<vlan_address_2>"
               set dstaddr "<vlan_address_1>"
               set action accept
               set schedule "always"
               set service "ALL"
               set nat disable
           next
       end
       ```

       Specify:

       * `<vlan_name_1>` — name of the first network interface;
       * `<vlan_name_2>` — name of the second network interface;
       * `<vlan_address_1>` — name of the IP address assigned to the first VLAN;
       * `<vlan_address_2>` — name of the IP address assigned to the second VLAN.

    2. Create two policies, one for each VLAN subnet, for internet access:

       ```bash
       config firewall system
           edit 5
               set name "<vlan_name_1> to Internet"
               set srcintf "<vlan_name_1>"
               set dstintf "wan1"
               set srcaddr "<vlan_address_1>"
               set dstaddr "all"
               set action accept
               set schedule "always"
               set service "ALL"
           next
           edit 6
               set name "<vlan_name_2> to Internet"
               set srcintf "<vlan_name_2>"
               set dstintf "wan1"
               set srcaddr "<vlan_address_2>"
               set dstaddr "all"
               set action accept
               set schedule "always"
               set service "ALL"
           next
       end
       ```

    Specify:

    * `<vlan_name_1>` — name of the first network interface;
    * `<vlan_name_2>` — name of the second network interface;
    * `<vlan_address_1>` — name of the IP address assigned to the first VLAN;
    * `<vlan_address_2>` — name of the IP address assigned to the second VLAN.
  </TabItem>
</Tabs>

<Formbricks />