# VLAN Interfaces and Basic Switching

> Chapter 12 of the Courseiva FORTINET-NSE4 curriculum — https://courseiva.com/learn/fortinet-nse4/vlan-interfaces-and-basic-switching

**Official objective:** 2.2 — Create VLAN interfaces and configure basic switching features such as DHCP relay and spanning tree protocol interaction.

## Introduction

How do you stop an office full of computers from shouting over each other and accidentally sending private data to the wrong person? This chapter solves the problem of splitting a single physical network into multiple, secure, virtual networks without buying new cables. For the NSE4 exam, you must understand how Fortinet firewalls create these virtual networks (VLANs) and control traffic between them using VLAN interfaces.

## The Gated Community and Apartment Keys Analogy

Because a company has different departments (Sales, HR, Engineering) that use the same building, the network would be chaotic and insecure if everyone shared one big open room. So you split the building into separate apartments, each with a key.

Think of a physical office building that houses three separate companies: a bakery, a law firm, and a tech start-up. All three companies share the same entrance hall, the same mailroom, and the same electrical wiring. The bakery's deliveries go to the same loading dock as the law firm's confidential documents. This is a massive security risk and privacy nightmare. To fix this, the building manager paints each floor a different colour and issues special keys. Everyone inside the building can still use the main entrance (the physical switch), but the colour of the floor and the key you hold determine exactly which rooms, hallways, and meeting spaces you can access. The bakery staff have a red key (VLAN 10) that only opens doors on the first floor. The law firm has a blue key (VLAN 20) for the second floor. The tech start-up has a green key (VLAN 30) for the third floor. When the mail (data) arrives at the main entrance, the doorman (the switch) checks the key colour on the envelope (the VLAN tag) and sends it directly to the correct floor without letting other floors see it. This keeps the bakery's flour orders separate from the law firm's case files, even though they share the same building, power, and front door. The 'VLAN interface' is like the electronic key reader on each floor's door that only allows access if your key colour matches.

## Core explanation

Imagine a single water pipe in a building. Everyone's water runs through the same pipe. If one person flushes a toilet, the pressure drops for the person taking a shower. This is how a basic network switch works without VLANs: all devices (computers, printers, servers) connected to the switch are on the same 'broadcast domain'. A broadcast is a shout-out to every device on the network. When a computer sends a broadcast, every single device must stop what it is doing, listen, and decide if the message is for it. This wastes time and creates a security risk because a malicious shout-out can be heard by everyone.

A VLAN (Virtual Local Area Network) is a technology that solves this by carving the single physical switch into multiple, isolated virtual switches. Think of it like painting different apartments on the same floor different colours. Even though they share the same physical floor (the switch), a person in the blue apartment cannot talk to a person in the red apartment without going through a special door (a router or a Layer 3 device). The switch uses a tag (a small label attached to the data) to know which 'colour' each piece of data belongs to. This tag is called a VLAN ID (e.g., VLAN 10, VLAN 20).

To make VLANs work across multiple switches (which is the real world), you need a trunk port. A trunk port is a special connection between two switches that carries traffic for many VLANs simultaneously. Imagine the hallway that connects the red apartment building to the blue apartment building: the mail carrier (the data) wears a coloured armband (the VLAN tag) the whole time, so the next building's doorman knows exactly which apartment to deliver it to. Without a trunk, the mail would lose its colour tag and get delivered to the wrong place.

Now, the 'VLAN interface' is the crucial concept for the NSE4 exam. A VLAN interface (often called a 'virtual interface' or 'VLAN SVI' - Switch Virtual Interface) is a software-based gateway that the FortiGate firewall creates to route traffic between different VLANs. A standard switch works at Layer 2, which only uses MAC addresses (like a person's unique name). It cannot route data between different coloured apartments. The FortiGate firewall, however, works at Layer 3 and can route traffic. By creating a VLAN interface (e.g., 'VLAN 10' with IP address 192.168.10.1), the FortiGate becomes the doorman for that specific apartment block. Every device in VLAN 10 will send its traffic 'up' to the firewall's VLAN interface when it needs to talk to a device in VLAN 20.

Basic switching features like Spanning Tree Protocol (STP) exist to prevent a network disaster called a 'broadcast storm'. If you connect three switches in a loop (Switch A to B, B to C, and C back to A), a broadcast message will circle forever, multiplying until the network crashes. STP is an intelligent system that automatically detects these loops and 'blocks' one of the links. It is like having a bridge with three lanes but automatically closing the middle lane to prevent a traffic jam of cars going in circles. The FortiGate can interact with STP, meaning it can listen to the network's 'bridge discussions' and decide which ports to use and which to block.

Finally, DHCP Relay is a service that solves a practical problem. A DHCP server is a centralised computer that hands out IP addresses (like a passport office issuing unique passport numbers). If you have five different VLANs (apartments), you usually want one DHCP server in the main office to issue addresses to everyone. However, DHCP requests are broadcasts, and broadcasts usually cannot cross VLAN boundaries. DHCP Relay is a feature on the FortiGate or a Layer 3 switch that takes the broadcast request from a device in VLAN 10, wraps it up like a normal letter, and sends it directly to the DHCP server. The server sends the address back, and the relay forwards it to the device. It is like a secretary in a company who takes a message from a department that cannot phone the CEO directly and calls the CEO on their behalf.

## Real-world context

An IT professional at a medium-sized company, GlobalTrade Ltd., is asked to design a new office network. The company has 200 employees split into four departments: Sales, Engineering, HR, and Finance. Without VLANs, all 200 computers would be on one flat network. A virus on a Sales computer would instantly have access to the Finance server because they are on the same network. The IT administrator would also struggle with congestion because all 200 devices would be shouting broadcast messages at each other.

The administrator decides to use VLANs. She creates four VLANs on the main office switch (a managed switch) and configures them on the FortiGate firewall:

- VLAN 10 for Sales, with the IP subnet 192.168.10.0/24
- VLAN 20 for Engineering, with the IP subnet 192.168.20.0/24
- VLAN 30 for HR, with the IP subnet 192.168.30.0/24
- VLAN 40 for Finance, with the IP subnet 192.168.40.0/24

She then configures a VLAN interface on the FortiGate for each of these VLANs, giving each a unique IP address (e.g., 192.168.10.1 for VLAN 10). This IP address becomes the 'default gateway' for all devices in that VLAN. Every computer in Sales will be configured to send all traffic destined for outside its own VLAN to 192.168.10.1.

Now, the administrator needs to handle internet access and inter-VLAN routing. She creates firewall policies on the FortiGate. For example, she creates a policy that allows traffic from VLAN 10 (Sales) to access the internet but blocks access to VLAN 40 (Finance). This is a core security requirement. She also enables DHCP Relay on the FortiGate's VLAN interfaces. The company has a central DHCP server at IP 10.0.0.5. When a new Sales employee plugs in a laptop, the laptop sends a broadcast DHCP request. Since it is in VLAN 10, the request cannot reach the server. The FortiGate's VLAN 10 interface catches this request, sees that DHCP Relay is enabled, and forwards it to 10.0.0.5. The server allocates an IP address (e.g., 192.168.10.50), and the relay sends it back to the laptop.

Finally, the administrator must deal with the physical connections between the office switch and the FortiGate. She configures a single physical port on the FortiGate as a 'trunk' (often called an 802.1Q trunk). This single cable carries traffic for all four VLANs simultaneously. The administrator tags the traffic leaving the switch with the correct VLAN ID, and the FortiGate's trunk port reads the tag and delivers the data to the correct VLAN interface inside the firewall. This saves physical ports and simplifies cabling. She also configures RSTP (Rapid Spanning Tree Protocol) on the network switches and ensures the FortiGate is configured to respect STP BPDU (Bridge Protocol Data Unit) packets, preventing accidental loops that could crash the entire office network.

## Exam focus

The NSE4 exam tests VLAN interfaces and basic switching heavily, but it does so in a specific, trap-laden way. You will not be asked to configure a 50-port switch. Instead, you will be given a scenario about a FortiGate firewall connected to a managed switch and asked to identify the correct configuration steps or the result of a misconfiguration.

The exam objectives (2.2) explicitly ask you to 'Create VLAN interfaces and configure basic switching features such as DHCP relay and spanning tree protocol interaction.' The key phrase is 'on the FortiGate'. NSE4 is about Fortinet gear. You must know exactly how the FortiGate handles VLANs, not just the general theory.

Specifically, the exam loves the following:

- The relationship between a physical interface and a VLAN interface. You must know that a VLAN interface is a child of a physical interface. For example, if you configure VLAN 10 on physical port 'port1', the FortiGate creates a logical interface called 'port1.10' (or 'VLAN10' depending on the firmware version). You cannot create a VLAN interface without a parent physical interface.
- The 'allowaccess' setting. This is a huge exam trap. The VLAN interface itself does not have IP management settings by default. To manage the firewall via a VLAN interface (e.g., using HTTPS to log into the web GUI from a computer in VLAN 10), you must specifically enable 'HTTPS' and 'PING' under the 'Administrative Access' options for that VLAN interface.
- DHCP Relay configuration. The exam expects you to know that DHCP Relay is configured under the 'DHCP Server' settings on the FortiGate, but you select 'Relay' as the mode. You must specify the IP address of the external DHCP server. The trap is that beginners think the FortiGate must be the DHCP server. The exam tests whether you know it can be a relay.
- STP interaction. The FortiGate is not a full STP switch. It can 'participate' by sending and receiving BPDU packets. The exam tests your understanding of 'port protection' features like 'root guard' and 'BPDU guard'. Specifically, if a port is configured with BPDU guard and it receives a BPDU packet, the port will be administratively disabled (shut down). The exam question might present a scenario where a loop occurs, and they ask 'why did the port go down?'.
- The difference between 'tagged' and 'untagged' VLANs on the switch side (which connects to the FortiGate). The FortiGate's VLAN interface expects tagged traffic. The exam will present a scenario where traffic is not working between a PC and the FortiGate. The answer is often that the switch port connected to the FortiGate must be configured as a trunk port with the specific VLAN tagged.

Common exam traps include:
- Asking you to create a VLAN interface without first assigning it to a physical interface.
- Asking about 'inter-VLAN routing' and expecting the answer that the FortiGate (acting as the Layer 3 device) does this via the VLAN interfaces, not the physical port.
- Providing a scenario where the DHCP Relay is not working because the 'server-ip' field is empty.
- Confusing a 'VLAN interface' with a 'software switch' interface. A software switch is for bridging, while a VLAN interface is for routing between VLANs.

## Step by step

1. **Define the VLANs** — First, plan which groups of users will be isolated from each other. For example, Sales (VLAN 10) and Engineering (VLAN 20). This step happens in your mind and on paper, not on the device. It defines the network segmentation strategy.
2. **Configure the Physical Port on the FortiGate** — Select the physical port that connects to the office switch (e.g., Port1). On this port, you must enable 'Administrative Access' if you want to manage the firewall through it. Then, configure the port as a 'trunk' by enabling '802.1Q' tagging. This tells the port to expect tagged traffic from the switch.
3. **Create the VLAN Interface on the FortiGate** — Navigate to Network -> Interfaces. Click 'Create New' and select 'VLAN'. Choose the parent interface (Port1), assign the VLAN ID (e.g., 10 for Sales), and give the new VLAN interface an IP address (e.g., 192.168.10.1/24). This IP becomes the default gateway for all devices in VLAN 10.
4. **Configure DHCP Relay (or DHCP Server) on the VLAN Interface** — Go to Network -> DHCP Server. Select the VLAN interface you just created. Choose 'Relay' mode. Enter the IP address of your central DHCP server (e.g., 10.0.0.5). This step ensures that devices in the new VLAN can automatically receive an IP address from the company's main server.
5. **Configure Firewall Policies for Inter-VLAN Routing** — Create Firewall Policies (Policy & Objects -> IPv4 Policy). Create a policy from the VLAN interface (e.g., VLAN 10) to the external interface (WAN) for internet access. Create another policy from VLAN 10 to VLAN 20 if Engineering needs to access Sales servers. Without these policies, VLANs remain isolated at Layer 3.

## Comparisons

### VLAN Interface (FortiGate) vs Physical Interface (FortiGate)

**VLAN Interface (FortiGate):**
- Logical interface created on top of a physical port
- Has an IP address that defines a subnet
- Used for routing traffic between different VLANs

**Physical Interface (FortiGate):**
- A physical port on the FortiGate device
- Typically does not have a LAN IP address; carries tagged traffic
- Used for connecting to a switch or other physical device

### Trunk Port vs Access Port

**Trunk Port:**
- Carries traffic for multiple VLANs simultaneously
- Uses 802.1Q tagging to identify each VLAN
- Typically connects switches to firewalls or between switches

**Access Port:**
- Carries traffic for only one VLAN (untagged)
- Does not add VLAN tags to the traffic
- Typically connects end devices like PCs or printers to a switch

### DHCP Relay vs DHCP Server

**DHCP Relay:**
- Forwards DHCP requests to a central server
- Does not manage or store IP address leases
- Works across VLAN boundaries

**DHCP Server:**
- Manages and leases IP addresses to devices
- Stores a database of assigned addresses
- Sits on the same subnet as the devices or requires a relay to receive requests

### Spanning Tree Protocol (STP) vs Routing Protocol (e.g., OSPF)

**Spanning Tree Protocol (STP):**
- Operates at Layer 2 (switch level)
- Prevents loops in a network by blocking redundant links
- Uses Bridge Protocol Data Units (BPDUs) to communicate

**Routing Protocol (e.g., OSPF):**
- Operates at Layer 3 (router level)
- Finds the best path between different networks
- Uses routing updates (e.g., LSAs) to share topology

## Diagram

_This diagram shows how a single physical port on a FortiGate carries traffic from three different VLANs using trunk tagging, and how each VLAN interface acts as a gateway for its respective PCs with DHCP relay forwarding requests to a central server._

```mermaid
flowchart TD
    A[Office Switch] -->|Trunk Port (802.1Q) - Tags traffic with VLAN ID| B[FortiGate Physical Port Port1]
    B --> C[VLAN Interface 10 - IP 192.168.10.1]
    B --> D[VLAN Interface 20 - IP 192.168.20.1]
    B --> E[VLAN Interface 30 - IP 192.168.30.1]
    C --> F[Sales PC - 192.168.10.50]
    D --> G[Engineering PC - 192.168.20.50]
    E --> H[HR PC - 192.168.30.50]
    F -.->|DHCP Request| I[DHCP Relay on VLAN 10]
    I --> J[Central DHCP Server 10.0.0.5]
```

## Common misconceptions

- **Misconception:** VLANs are a security feature that completely isolates traffic, so no data can ever leave my VLAN without my permission. **Reality:** VLANs isolate traffic at Layer 2 (the switch level). Traffic can still leave your VLAN if a Layer 3 device (like a FortiGate firewall) is configured with VLAN interfaces and a firewall policy allows it. VLANs alone do not block routing; they just limit broadcast domains. (Beginners hear 'isolated' and assume it means total, unbreakable isolation, forgetting that routers and firewalls are designed to break that isolation to allow controlled access.)
- **Misconception:** To create a VLAN on a FortiGate, I must first buy a managed switch and configure VLANs on that switch. **Reality:** You can create a VLAN interface directly on a FortiGate firewall without any managed switch. The VLAN interface is a logical construct on the firewall. You do need a managed switch to tag traffic arriving at the firewall's physical port, but the firewall itself can create the VLAN and route traffic. (Beginners assume VLANs are a 'switch-only' feature because they first encounter VLANs in the context of network switches, not firewalls.)
- **Misconception:** DHCP Relay and DHCP Server are the same thing, just different names. **Reality:** A DHCP Server allocates and manages IP addresses. A DHCP Relay is a middleman. It forwards DHCP requests from a VLAN to a central DHCP server. The relay does not store or manage any IP addresses; it just passes the message along. (The word 'relay' sounds passive, but beginners often assume it means 'relay server' implying some server functionality, which leads to confusion about configuration.)
- **Misconception:** Spanning Tree Protocol (STP) is unnecessary if I have a modern network. It slows down the network by blocking links. **Reality:** STP is still essential in any network with redundancy. Without STP, a single accidental loop (like plugging a cable into the wrong port) can cause a catastrophic broadcast storm that crashes the network. STP prevents this by blocking redundant links, not by throttling traffic. (Beginners see 'blocking' as negative and assume modern switches are smart enough to avoid loops, underestimating how easy it is to create a loop accidentally.)
- **Misconception:** A VLAN interface on a FortiGate needs an IP address in the same range as the physical port it is attached to. **Reality:** A VLAN interface must have an IP address from the subnet it serves (e.g., 192.168.10.1 for VLAN 10). The physical parent port (e.g., port1) typically does not have an IP address, or it has a different management IP. The physical port just carries tagged traffic; it is the logical interface that acts as the gateway. (Beginners confuse the physical interface's role (carrier of tagged traffic) with the logical interface's role (gateway for a specific VLAN).)

## Key takeaways

- A VLAN (Virtual Local Area Network) splits a single physical switch into multiple, isolated broadcast domains, preventing traffic from one group from reaching another without a router.
- A VLAN interface on a FortiGate is a logical Layer 3 interface that acts as the default gateway for all devices inside that specific VLAN.
- A trunk port (802.1Q) is the connection that carries traffic for multiple VLANs simultaneously, using tags to identify each data packet's VLAN membership.
- DHCP Relay is a service on a FortiGate that forwards DHCP broadcast requests from a VLAN to a central DHCP server located in a different subnet.
- Spanning Tree Protocol (STP) automatically prevents network loops by blocking redundant paths; a loop can cause a broadcast storm that crashes the network.
- The NSE4 exam frequently tests the 'allowaccess' setting on a VLAN interface, requiring you to enable HTTPS or PING to manage the firewall from that VLAN.
- A VLAN interface must be created on a parent physical interface; you cannot create a VLAN interface without first selecting which physical port it belongs to.

## FAQ

**Do I need a managed switch to use VLANs on a FortiGate?**

No, you do not strictly need a managed switch. You can create VLAN interfaces directly on the FortiGate. However, to actually connect multiple devices from different VLANs to the same FortiGate port, you will need a managed switch that can tag traffic with the correct VLAN ID.

**What does a VLAN tag look like in data?**

A VLAN tag is a small four-byte field inserted into the Ethernet frame (the data packet). It contains a 12-bit VLAN ID (0-4095). The switch and firewall read this tag to determine which virtual network the packet belongs to.

**Can two VLANs share the same IP subnet?**

No. Each VLAN must have its own unique IP subnet (e.g., VLAN 10 uses 192.168.10.0/24, VLAN 20 uses 192.168.20.0/24). If two VLANs used the same subnet, devices would be unable to distinguish each other and routing would break.

**Why does my FortiGate show an 'interface administratively down' error after I configure VLANs?**

This usually happens because the physical parent port is set to 'off' or is not connected. The VLAN interface is a child of the physical port. If the physical port is down, all VLAN interfaces on that port will also show as down. Check the physical cable and port status first.

**What is the difference between a VLAN interface and a software switch on FortiGate?**

A VLAN interface is a Layer 3 interface used for routing between different subnets. A software switch is a Layer 2 construct that groups multiple physical ports into a single broadcast domain (like a regular switch). You use a VLAN interface for inter-VLAN routing, and a software switch for simple port bridging.

**Is 'VLAN 1' special?**

Yes, VLAN 1 is the default VLAN on most managed switches. All switch ports are in VLAN 1 by default. It is strongly recommended to change this for security reasons, as attackers often target the default VLAN.

## Check your understanding

1. **What is the primary purpose of a VLAN on a network switch?**

   Answer: A VLAN splits a single physical switch into multiple isolated broadcast domains, separating traffic between different groups of devices.

2. **On a FortiGate firewall, what must you create to allow devices in VLAN 10 to communicate with devices in VLAN 20?**

   Answer: You must create a firewall policy that permits traffic from the VLAN 10 interface to the VLAN 20 interface, with the correct source and destination addresses.

3. **What does DHCP Relay do when a broadcast DHCP request arrives from a VLAN?**

   Answer: It converts the broadcast request into a unicast message and forwards it directly to the specified central DHCP server's IP address.

4. **If you accidentally connect two switches together in a loop without STP, what will likely happen to the network?**

   Answer: A broadcast storm will occur, where broadcast frames circulate endlessly, multiplying and eventually consuming all available bandwidth and crashing the network.

5. **When configuring a VLAN interface on a FortiGate, which setting must you enable to be able to log into the firewall's web GUI from a computer inside that VLAN?**

   Answer: You must enable 'HTTPS' under the 'Administrative Access' settings for that specific VLAN interface.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/fortinet-nse4/vlan-interfaces-and-basic-switching