Technical Tip: How to tagged an untagged packet with FortiGate in transparent mode

syao · ‎12-27-2023

Description

This article describes how to tag an untagged packet with FortiGate in transparent mode in a Single or Multi-VDOM environment.

Scope

FortiGate v7.X.

Solution

This article assumes the network infrastructure in the following diagram is in place:

ISP offers a VoIP solution and requires the IP phones to communicate over VLAN400. However, it has only one physical connection to the FortiGate (port1). The ISPs are using two VLANs: VLAN500 for Data (not shown in this example) and VLAN400 for Voice.
The ISP is not aware that IP phones are connected to port3 of the FortiGate. These devices are not able to send VLAN-tagged frames and require DHCP to obtain an IP.
This setup can usually be found in small offices/branch offices in which a VLAN-aware switch is unavailable. The FortiGate port3 interface is solely dedicated to the IP phones segment.
This example uses a multiVDOM (NAT and Transparent) approach in which port3 and a VLAN interface are assigned to a dedicated transparent VDOM for Voice traffic.

Convert the FortiGate (voice vdom) operation mode to transparent mode.

config system settings

set opmode transparent
set manageip 192.168.1.10/255.255.255.0

end

Create the VLAN interface and assign both interfaces (VLAN and port3) to the VDOM. Note: If multiVDOM is in use, the VLAN interface must be created from the 'Global'.

config system interface

edit "port3"

set vdom "VOICE-VDOM"
set type physical
set alias "Connected to IP Phones"
set snmp-index 3

set vdom "VOICE-VDOM"
set alias "Connected To ISP"
set device-identification enable
set snmp-index 9
set interface "port1"
set vlanid 400

Configure firewall policy between the two interfaces:

config firewall policy

edit 1

set name "INTERNAL-EXTERNAL-VLAN400"
set srcintf "port3"
set dstintf "VOICE_EXTERNAL"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"

set name "EXTERNAL-INTERNAL-VLAN400"
set srcintf "VOICE_EXTERNAL"
set dstintf "port3"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"

Verification:

DHCP Discover a packet captured from Port3 of the FortiGate:

DHCP Discover a packet captured from the Port1 of the FortiGate: