Configure VLAN

Last update: October 05 2026Open in Markdown

Virtual Local Area Networks (VLANs) allow you to segment a network, increase performance, and provide additional network security.

The instructions are relevant for FortiOS versions 6.x and 7.x. If you have a different version of FortiOS, you can find documentation for it in the upper right corner of the FortiGate control panel or on the official FortiGate website.

To create two virtual networks with access to each other and the internet:

1. Create network interfaces.
2. Configure the security policy.

Create network interfaces

Graphical interface

FortiOS 6.x

1. Connect to the firewall.

2. Go to Network → Interfaces.

3. Specify the interface name.

4. In the Type field, select VLAN.

5. In the VLAN ID field, specify the network ID.

6. In the Role field, select LAN.

7. In the IP/Netmask field, specify the IP address and subnet mask for the VLAN.

8. Click OK.

9. Repeat steps 1—8 to create the second network interface.

10. Go to Policy & Objects → Addresses.

11. Click Create new.

FortiOS 7.x

1. Connect to the firewall.

2. Go to Network → Interfaces.

3. Select Create New → Interface.

4. Specify the interface name.

5. In the Type field, select VLAN.

6. Specify the network ID in the VLAN ID field.

7. In the Role field, select LAN.

8. In the IP/Netmask field, specify the address and subnet mask.

9. Enable Create address object matching subnet. An address for the VLAN will be automatically created in Policy & Objects → Addresses.

10. Repeat steps 1–9 to create the second network interface.

CLI

1. Connect to the firewall.

2. Create two interfaces:

   config system interface
        edit "<vlan_name_1>"
            set vdom root
            set ip <ip_address_1> <mask_1>
            set allowaccess ping https ssh
            set role lan
            set interface lan
            set vlanid <vlan_id_1>
        next
        edit "<vlan_name_2>"
            set vdom root
            set ip <ip_address_2> <mask_2>
            set allowaccess ping https ssh
            set role lan
            set interface lan
            set vlanid <vlan_id_2>
   end

   Specify:

   • <vlan_name_1> — name of the first network interface;
   • <ip_address_1> — IP address that will be assigned to the first interface;
   • <mask_1> — subnet mask of the first interface like 255.255.255.0;
   • <vlan_id_1> — ID of the first interface;
   • <vlan_name_2> — name of the second interface;
   • <ip_address_2> — IP address that will be assigned to the second interface;
   • <mask_2> — subnet mask of the second interface like 255.255.255.0;
   • <vlan_id_2> — ID of the second VLAN.

3. Add two addresses for the created VLANs:

   config firewall address
       edit <vlan_address_1>
           set type ipmask
           set subnet <ip_address_1> <mask_1>
       next
       edit <vlan_address_2>
           set type ipmask
           set subnet <ip_address_2> <mask_2>
    end

   Specify:

   • <vlan_address_1> — name of the IP address assigned to the first VLAN;
   • <ip_address_1> — IP address assigned to the first VLAN;
   • <mask_1> — subnet mask of the first VLAN;
   • <vlan_address_2> — name of the IP address assigned to the second VLAN;
   • <ip_address_2> — IP address assigned to the second VLAN;
   • <mask_2> — subnet mask of the second VLAN.

Configure the security policy

Graphical interface

1. Go to Policy & Objects → IPv4 Policy and create a new policy.

2. In the Incoming Interface field, select the first VLAN.

3. In the Outgoing Interface field, select the second VLAN.

4. In the Source field, select the address of the first VLAN.

5. In the Destination field, select the address of the second VLAN.

6. Make sure that NAT is disabled in the policy.

7. Repeat steps 1–6 to create the second policy. In this policy, swap the first and second VLANs.

8. Go to Policy & Objects → IPv4 Policy and create a new policy.

9. In Incoming Interface, select the first VLAN.

10. In Outgoing Interface, select the external interface.

11. In Source, select the address of the first VLAN.

12. In Destination, select the address of the external interface.

13. Repeat steps 8–12 to create a policy for the second VLAN.

CLI

1. Create a new policy:

   config firewall policy
       edit 3
           set name "<vlan_name_1> to <vlan_name_2>"
           set srcintf "<vlan_name_1>"
           set dstintf "<vlan_name_2>"
           set srcaddr "<vlan_address_1>"
           set dstaddr "<vlan_address_2>"
           set action accept
           set schedule "always"
           set service "ALL"
           set nat disable
       next
       edit 4
           set name "<vlan_name_2> to <vlan_name_1>"
           set srcintf "<vlan_name_2>"
           set dstintf "<vlan_name_1>"
           set srcaddr "<vlan_address_2>"
           set dstaddr "<vlan_address_1>"
           set action accept
           set schedule "always"
           set service "ALL"
           set nat disable
       next
   end

   Specify:

   • <vlan_name_1> — name of the first network interface;
   • <vlan_name_2> — name of the second network interface;
   • <vlan_address_1> — name of the IP address assigned to the first VLAN;
   • <vlan_address_2> — name of the IP address assigned to the second VLAN.

2. Create two policies, one for each VLAN subnet, for internet access:

   config firewall system
       edit 5
           set name "<vlan_name_1> to Internet"
           set srcintf "<vlan_name_1>"
           set dstintf "wan1"
           set srcaddr "<vlan_address_1>"
           set dstaddr "all"
           set action accept
           set schedule "always"
           set service "ALL"
       next
       edit 6
           set name "<vlan_name_2> to Internet"
           set srcintf "<vlan_name_2>"
           set dstintf "wan1"
           set srcaddr "<vlan_address_2>"
           set dstaddr "all"
           set action accept
           set schedule "always"
           set service "ALL"
       next
   end

Specify:

• <vlan_name_1> — name of the first network interface;
• <vlan_name_2> — name of the second network interface;
• <vlan_address_1> — name of the IP address assigned to the first VLAN;
• <vlan_address_2> — name of the IP address assigned to the second VLAN.