Configure VLAN

Last update: May 30 2026

Virtual Local Area Networks (VLANs) allow you to segment a network, increase performance, and provide additional network security.

The settings in this guide are relevant for FortiOS versions 6.x and 7.x. If you have a different version of FortiOS, you can find the documentation for it in the FortiGate control panel in the upper right corner or on the official FortiGate website.

To create two virtual networks with access to each other and the internet:

1. Create network interfaces.
2. Configure the security policy.

Create network interfaces

Graphical interface

FortiOS 6.x

1. Connect to the firewall.

2. Go to the Network → Interfaces tab.

3. Specify the interface name.

4. In the Type field, select — VLAN.

5. In the VLAN ID field, specify the network identifier.

6. In the Role field, select — LAN.

7. In the IP/Netmask field, specify the IP address and subnet mask for the VLAN.

8. Click OK.

9. Repeat steps 1—8 to create the second network interface.

10. Go to the Policy & Objects → Addresses section.

11. Click Create new.

FortiOS 7.x

1. Connect to the firewall.

2. Go to the Network → Interfaces tab.

3. Select Create New → Interface.

4. Specify the interface name.

5. In the Type field, select — VLAN.

6. Specify the network identifier in the VLAN ID field.

7. In the Role field, select — LAN.

8. In the IP/Netmask field, specify the IP address and subnet mask.

9. Enable Create address object matching subnet. An address for the VLAN will be automatically created in the Policy & Objects → Addresses section.

10. Repeat steps 1–9 to create the second network interface.

CLI

1. Connect to the firewall.

2. Create two interfaces:

   config system interface
        edit "<vlan_name_1>"
            set vdom root
            set ip <ip_address_1> <mask_1>
            set allowaccess ping https ssh
            set role lan
            set interface lan
            set vlanid <vlan_id_1>
        next
        edit "<vlan_name_2>"
            set vdom root
            set ip <ip_address_2> <mask_2>
            set allowaccess ping https ssh
            set role lan
            set interface lan
            set vlanid <vlan_id_2>
   end

   Specify:

   • <vlan_name_1> — the name of the first network interface;
   • <ip_address_1> — the IP address to be assigned to the first interface;
   • <mask_1> — subnet mask for the first interface, e.g., 255.255.255.0;
   • <vlan_id_1> — the identifier of the first interface;
   • <vlan_name_2> — the name of the second interface;
   • <ip_address_2> — the IP address to be assigned to the second interface;
   • <mask_2> — subnet mask for the second interface, e.g., 255.255.255.0;
   • <vlan_id_2> — the identifier of the second VLAN.

3. Add two addresses for the created VLANs:

   config firewall address
       edit <vlan_address_1>
           set type ipmask
           set subnet <ip_address_1> <mask_1>
       next
       edit <vlan_address_2>
           set type ipmask
           set subnet <ip_address_2> <mask_2>
    end

   Specify:

   • <vlan_address_1> — the name of the IP address assigned to the first VLAN;
   • <ip_address_1> — the IP address assigned to the first VLAN;
   • <mask_1> — the subnet mask of the first VLAN;
   • <vlan_address_2> — the name of the IP address assigned to the second VLAN;
   • <ip_address_2> — the IP address assigned to the second VLAN;
   • <mask_2> — the subnet mask of the second VLAN.

Configure the security policy

Graphical interface

1. Go to the Policy & Objects → IPv4 Policy section and create a new policy.

2. In the Incoming Interface field, select the first VLAN.

3. In the Outgoing Interface field, select the second VLAN.

4. In the Source field, select the address of the first VLAN.

5. In the Destination field, select the address of the second VLAN.

6. Make sure that NAT is disabled in the policy.

7. Repeat steps 1–6 to create the second policy. In this policy, swap the first and second VLANs.

8. Go to the Policy & Objects → IPv4 Policy section and create a new policy.

9. In Incoming Interface, select the first VLAN.

10. In Outgoing Interface, select the external interface.

11. In Source, select the address of the first VLAN.

12. In Destination, select the address of the external interface.

13. Repeat steps 8–12 to create a policy for the second VLAN.

CLI

1. Create a new policy:

   config firewall policy
       edit 3
           set name "<vlan_name_1> to <vlan_name_2>"
           set srcintf "<vlan_name_1>"
           set dstintf "<vlan_name_2>"
           set srcaddr "<vlan_address_1>"
           set dstaddr "<vlan_address_2>"
           set action accept
           set schedule "always"
           set service "ALL"
           set nat disable
       next
       edit 4
           set name "<vlan_name_2> to <vlan_name_1>"
           set srcintf "<vlan_name_2>"
           set dstintf "<vlan_name_1>"
           set srcaddr "<vlan_address_2>"
           set dstaddr "<vlan_address_1>"
           set action accept
           set schedule "always"
           set service "ALL"
           set nat disable
       next
   end

   Specify:

   • <vlan_name_1> — name of the first network interface;
   • <vlan_name_2> — name of the second network interface;
   • <vlan_address_1> — name of the IP address assigned to the first VLAN;
   • <vlan_address_2> — name of the IP address assigned to the second VLAN.

2. Create two policies, one for each VLAN subnet, for internet access:

   config firewall system
       edit 5
           set name "<vlan_name_1> to Internet"
           set srcintf "<vlan_name_1>"
           set dstintf "wan1"
           set srcaddr "<vlan_address_1>"
           set dstaddr "all"
           set action accept
           set schedule "always"
           set service "ALL"
       next
       edit 6
           set name "<vlan_name_2> to Internet"
           set srcintf "<vlan_name_2>"
           set dstintf "wan1"
           set srcaddr "<vlan_address_2>"
           set dstaddr "all"
           set action accept
           set schedule "always"
           set service "ALL"
       next
   end

Specify:

• <vlan_name_1> — name of the first network interface;
• <vlan_name_2> — name of the second network interface;
• <vlan_address_1> — name of the IP address assigned to the first VLAN;
• <vlan_address_2> — name of the IP address assigned to the second VLAN.