VLANs and inter-VLAN routing: the core trick that lets a single physical network act like many separate, secure networks without buying extra cables or switches. For the NSE7 exam, you need to understand how to configure and troubleshoot this 'virtual splitting' because it's the foundation of almost every corporate network deployment Fortinet sells.
Jump to a section
A simple way to picture FortiGate VLAN and Inter-VLAN Routing
3 floors in an apartment building. Each floor is a separate department: Floor 1 is Sales, Floor 2 is Engineering, and Floor 3 is HR. The building has one main mailroom on the ground floor where all incoming post arrives. The post is sorted by the mailroom manager, who then delivers it to the correct floor. But there's a problem: if someone on Floor 2 (Engineering) wants to send a document to someone on Floor 3 (HR), they can't just walk up the stairs directly — because each floor has a locked door and its own internal security guard. Instead, the document must go back down to the main mailroom, be re-sorted, and then taken up to Floor 3. This is exactly how inter-VLAN routing works on a FortiGate. Each VLAN is like a separate floor — it's a virtual network segment that's isolated from the others. The FortiGate is the mailroom manager, acting as a router to move traffic between VLANs. Without the FortiGate, devices on different VLANs can't communicate at all, just like people on different floors without the mailroom. The real efficiency trick is that the FortiGate can also inspect and filter that mail between floors, adding security gates that a simple stairwell would never have.
In a modern office, this setup means the Sales team's computers (VLAN 10) can't snoop on Engineering's servers (VLAN 20) unless the FortiGate explicitly allows it. The analogy holds because the physical wiring is shared — all floors plug into the same electrical grid — but the logical separation (the locked doors) is enforced by the FortiGate's routing rules.
A VLAN, or Virtual Local Area Network, is a way to chop one physical switch into multiple smaller, isolated networks. Imagine you have a 24-port switch in your office. Without VLANs, every device plugged into that switch can talk to every other device — it's one flat network. With VLANs, you tell the switch: 'Ports 1-8 belong to Sales, ports 9-16 belong to Engineering, and ports 17-24 belong to HR.' Now a computer on port 3 cannot talk directly to a computer on port 10 unless the FortiGate routes the traffic between them.
Technically, a VLAN is identified by a number called a VLAN ID, which ranges from 1 to 4094. When a device sends a packet out of a switch port that's part of a VLAN, the packet gets a special tag (called an 802.1Q tag) slapped onto it before it leaves the switch. This tag tells the next device — usually a router like a FortiGate — which VLAN the packet came from. The FortiGate then inspects the tag and decides whether to forward the packet to another VLAN or block it.
Why would you want this? Two big reasons: security and traffic management. In the old days, you had to buy a separate physical switch for every department or security zone, which cost a fortune and took up space. VLANs let you do it virtually. Also, if you need to limit broadcast traffic — those noisy 'hello, is anyone there?' messages that devices send out — VLANs keep broadcasts inside their own group, so a storm in the Sales VLAN doesn't crash the Engineering network.
Now, inter-VLAN routing is what happens when a device in VLAN 10 needs to talk to a device in VLAN 20. A simple switch can't do this because the switch only looks at the VLAN tag and moves the packet within the same VLAN. For traffic to cross VLANs, it must go through a layer-3 device — a router — that can read the destination IP address and make a forwarding decision. The FortiGate acts as this router. On the FortiGate, you create a VLAN sub-interface for each VLAN that you want to route between. For example, you might create 'port1.10' for VLAN 10 and 'port1.20' for VLAN 20. Each sub-interface gets its own IP address (like 192.168.10.1 for VLAN 10 and 192.168.20.1 for VLAN 20). The FortiGate then builds a routing table and uses firewall policies to decide which traffic can pass between these VLANs.
The exam loves to test the concept that inter-VLAN routing is not automatic. You must configure two things on the FortiGate:
Routing: The FortiGate has to know how to reach each VLAN's network. Usually, if the VLAN sub-interface is directly connected, the route appears automatically as a connected route.
Firewall policies: By default, the FortiGate blocks all traffic between VLANs. You must create explicit policies that say 'allow traffic from VLAN 10 (source) to VLAN 20 (destination) on this port, using this service (e.g., HTTP, ping).'
A common trap in the exam is forgetting that VLANs are layer-2 constructs and inter-VLAN routing is a layer-3 function. You might have all the VLAN sub-interfaces correctly created, but if the firewall policy is missing, traffic will be silently dropped.
Plan the VLAN topology
Determine which devices belong to which logical group (e.g., Sales, Engineering, Guest). Assign a unique VLAN ID and IP subnet for each group. Decide if the FortiGate will use a single trunk port or multiple physical ports.
Configure VLANs on the switch
On the managed switch, create the VLANs (e.g., VLAN 10, VLAN 20). Configure switch ports as access ports for endpoints (each port belongs to one VLAN) and trunk ports for links to the FortiGate (carrying multiple VLANs tagged).
Create VLAN sub-interfaces on the FortiGate
In the FortiGate GUI, go to Network > Interfaces, click 'Create New', choose 'VLAN'. Set the parent interface to the trunk port (e.g., port1), the VLAN ID (e.g., 10), and assign an IP address (e.g., 192.168.10.1/24). Repeat for each VLAN.
Configure firewall policies for inter-VLAN traffic
Go to Policy & Objects > Firewall Policy. Create a new policy with the source interface (e.g., VLAN 10), destination interface (e.g., VLAN 20), source addresses (e.g., all or specific subnets), destination addresses, and services (e.g., HTTP, ping). Set action to 'Accept' and enable logging.
Test and verify connectivity
From a device in one VLAN, try to ping a device in another VLAN. Use the FortiGate's CLI: 'execute ping-options source <IP>' then 'execute ping <dest IP>' to test routing. Use 'diagnose debug flow' to trace packet processing if traffic fails.
Troubleshoot with diagnostic tools
If traffic is blocked, check 'diagnose debug flow' output: it shows whether the packet hits a policy, is denied by a policy, or has no matching route. Also use 'diagnose firewall iprope lookup' to see which policy order applies.
Consider a medium-sized company called 'GreenLeaf Organics' that has 80 employees in one office. The IT manager, Priya, is fed up with constant complaints: the accounting team's printer keeps getting flooded with marketing videos, and the IT admin's monitoring software can't find the CEO's laptop because they're on different parts of the network. Priya decides to implement VLANs using a single FortiGate 60F and three managed switches.
Step 1: She plans the VLANs. She assigns:
VLAN 10 (Management): for IT staff, servers, and network admin devices
VLAN 20 (Finance): for accounting, payroll, and sensitive financial systems
VLAN 30 (Staff): for all regular employees' desktops and Wi-Fi access
VLAN 40 (Guest): for visitors and contractors, with internet-only access, no internal resources
Step 2: She configures the switches to assign ports to specific VLANs. For example, the finance team's PCs are plugged into switch ports configured with 'access vlan 20'. The IT server rack ports are set to 'trunk mode', meaning they carry all VLANs tagged because the FortiGate needs to see all the VLAN tags.
Step 3: On the FortiGate, Priya creates VLAN sub-interfaces. She goes to Network > Interfaces, clicks 'Create New', selects 'VLAN', and names it 'Finance'. She sets the physical interface to 'port1' (the trunk port connected to the switch) and the VLAN ID to 20. She assigns an IP address: 192.168.20.1/24. She repeats this for VLAN 10 (192.168.10.1/24), VLAN 30 (192.168.30.1/24), and VLAN 40 (192.168.40.1/24).
Step 4: She creates firewall policies. A typical policy might be:
From: VLAN 30 (Staff) To: VLAN 10 (Management) — but only allow traffic to the print server and file server, not to the network admin console.
From: VLAN 40 (Guest) To: VLAN 20 (Finance) — block everything because guests shouldn't see financial data.
From: VLAN 20 (Finance) To: VLAN 10 (Management) — allow for backup and audit purposes.
Step 5: She tests. She tries to ping from her own laptop (on VLAN 30) to the finance server (VLAN 20). The ping fails because there's no policy allowing ICMP echo. She adds a specific policy for ICMP, and then the ping works. She also creates a policy for HTTP/HTTPS so the finance team can access a web-based accounting app hosted on a server in VLAN 10.
What actually happens is that every packet leaving the FortiGate to go from one VLAN to another is inspected by both the routing table and the firewall policies. The FortiGate logs any dropped packets, which helps Priya debug when someone complains they can't access a resource.
The result: GreenLeaf Organics now has a secure, segmented network. The marketing videos don't flood the finance printer because they're on separate VLANs. The IT admin can monitor all devices because the management VLAN has the right routing. Priya saved money because she didn't need to buy separate switches for each department. She only needed a single FortiGate and a few switches.
The NSE7 exam objective 2.2 tests your ability to configure and troubleshoot VLANs and inter-VLAN routing on FortiGate devices. Here is exactly what you need to know:
Exam love-to-test concepts:
VLAN ID range (1-4094, with 0 and 4095 reserved). The exam might present a hypothetical situation where someone uses VLAN ID 4095, which is invalid.
The difference between access ports (carry one untagged VLAN) and trunk ports (carry multiple tagged VLANs). Expect a scenario where a switch port configured as access suddenly needs to carry two VLANs — you must change it to trunk.
The concept of 'native VLAN' on a trunk port — if the switch and FortiGate have mismatched native VLANs, packets will be mis-tagged and routing will break.
Firewall policies are mandatory for inter-VLAN routing. The exam often shows a debug output where traffic reaches the FortiGate but gets dropped — the solution is to check the policy list.
The CLI commands: 'show system interface', 'config system interface', 'show firewall policy', 'diagnose firewall iprope lookup'. Be able to read output from 'diagnose debug flow' to see why a packet is dropped.
The order of operations: routing happens first (destination-based), then security policy inspection. If the route is missing, the packet is dropped with 'no matching route' even if a firewall policy exists.
Common trap patterns: - 'The FortiGate automatically routes between all VLANs when they are configured on the same physical interface.' This is false. You must create policies. - 'A VLAN sub-interface must have its own MAC address.' Actually, it inherits the MAC address of the parent physical interface by default, but you can assign a different one. The exam might test that the MAC address is the same unless you change it. - 'You need a separate physical port for each VLAN on the FortiGate.' False — one trunk port can carry many VLANs. - 'Ping between VLANs will always work if the IP addresses are on the same subnet.' That would defeat the purpose — they must be on different subnets. The exam may present a misconfiguration where both VLANs accidentally use the same subnet.
Key definitions to memorise:
VLAN ID: a 12-bit field in the 802.1Q header, giving 4096 possible values (0-4095).
Sub-interface: a logical interface created on top of a physical interface, identified by a VLAN ID.
Inter-VLAN routing: the process of forwarding packets from one VLAN to another, performed by a layer-3 device (router or layer-3 switch).
Tagged vs untagged: a tagged port adds the VLAN ID to the Ethernet frame; an untagged port expects packets without a VLAN tag (access port).
Question types: multiple-choice (single answer), multiple-select (pick 2-3 correct options), and scenario-based (read a description of a network problem and choose the fix). Expect at least two questions on VLANs and inter-VLAN routing in the NSE7 exam.
A VLAN isolates broadcast domains and provides logical segmentation at layer 2, but does not encrypt or secure traffic by itself.
Inter-VLAN routing on a FortiGate requires both a valid route and an explicit firewall policy allowing the traffic.
VLAN IDs range from 1 to 4094, with 0 and 4095 reserved — never use these in production.
A trunk port carries multiple tagged VLANs between switches or between a switch and a firewall, while an access port carries a single untagged VLAN.
The FortiGate's VLAN sub-interface inherits the MAC address of its physical parent by default, but this can be overridden.
Firewall policies on the FortiGate evaluate traffic in order (top-down) and if no policy matches, the traffic is denied and logged.
Diagnose ‘debug flow’ is the go-to tool for troubleshooting inter-VLAN routing failures on the FortiGate.
These come up on the exam all the time. Here's how to tell them apart.
Access Port
Carries traffic for only one VLAN
Does not add 802.1Q tags to frames
Used for connecting endpoint devices like PCs or printers
Trunk Port
Carries traffic for multiple VLANs simultaneously
Adds 802.1Q tags to identify each frame's VLAN
Used for connecting switches to each other or to a firewall
VLAN Tagged Frame
Contains an 802.1Q header with a VLAN ID (12 bits)
Used on trunk ports to identify VLAN membership
Can carry multiple VLANs over a single link
VLAN Untagged Frame
Contains no VLAN header
Used on access ports where only one VLAN exists
Simpler but limited to one VLAN per link
Layer-2 Switch with VLANs
Cannot route between VLANs by itself
Forwards frames based on MAC addresses only
Requires an external router or L3 module for inter-VLAN traffic
Layer-3 FortiGate with Inter-VLAN Routing
Routes between VLANs using IP addresses
Forwards packets based on destination IP and firewall policies
Combines routing, firewall, and security inspection in one device
Native VLAN on Trunk
The VLAN that carries untagged traffic on a trunk port
Must match on both ends of a trunk link to avoid misconfiguration
Often used for management traffic
VLAN 1 (Default VLAN)
The default VLAN on most switches
Carries all traffic until you create other VLANs
Commonly recommended to change for security reasons (to avoid VLAN hopping)
Mistake
VLANs provide security because they encrypt all traffic between devices.
Correct
VLANs do not encrypt anything. They segment traffic at layer 2, but the traffic is still in plain text unless you add encryption (like IPsec or SSL VPN).
The word 'virtual' makes people assume that virtual equals 'safe'. In reality, VLAN hopping attacks exist, and a misconfigured trunk can expose traffic across VLANs.
Mistake
If I create a VLAN sub-interface on the FortiGate, traffic between VLANs works automatically.
Correct
The FortiGate will route traffic only if both a valid route exists and a firewall policy permits the traffic. No policy means no traffic.
People familiar with layer-3 switches (which can route between VLANs with a single 'ip routing' command) assume the FortiGate behaves the same way. But the FortiGate is a firewall first — it denies by default.
Mistake
A VLAN can only be used on a single physical switch.
Correct
A VLAN can span multiple physical switches if they are interconnected via trunk ports. This is called a 'VLAN trunk' and is very common in data centres.
Beginners think physical switches are independent islands. They don't understand that trunk ports carry VLAN tags between switches, creating one logical switch across hardware.
Mistake
The FortiGate's VLAN sub-interface must have the same MAC address as the physical parent interface.
Correct
By default, the sub-interface inherits the parent MAC address, but you can change it. The exam expects you to know it's configurable, not fixed.
Most documentation shows the default behaviour, and learners don't explore that you can use the 'set mac-addr' command to assign a different MAC. It's a minor but testable detail.
Mistake
Inter-VLAN routing bypasses firewall inspection because it's just 'routing'.
Correct
On a FortiGate, inter-VLAN routing always goes through firewall inspection. The router and firewall are integrated — there is no 'pure routing' mode that bypasses policies.
On traditional routers (like Cisco IOS), routing between VLANs is a pure layer-3 function without firewall. People bring that expectation to the FortiGate, which is a security appliance.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A VLAN sub-interface is a logical interface created on top of a physical port, identified by a VLAN ID. It allows the FortiGate to route traffic for a specific VLAN as if it were a separate network port.
Yes. The FortiGate denies all inter-VLAN traffic by default. You must create explicit firewall policies to allow traffic from one VLAN to another.
Yes. Configure the port as a trunk (accept tagged frames). Then create multiple VLAN sub-interfaces on that port, each with a different VLAN ID and IP subnet.
An access port carries traffic for a single VLAN without tagging. A trunk port carries traffic for multiple VLANs, using 802.1Q tags to identify which VLAN the frame belongs to.
Use 'diagnose debug flow' to trace a packet and see where it's dropped. Common causes: missing firewall policy, no route to destination, or incorrect VLAN ID on the switch port.
No. Each VLAN must have a unique IP subnet (e.g., 192.168.10.0/24 for VLAN 10, 192.168.20.0/24 for VLAN 20). Overlapping subnets break routing and cause confusion.
You've finished FortiGate VLAN and Inter-VLAN Routing. Continue through the NSE7 study guide to build a complete picture of the exam.
Done with this chapter?