Although the FortGate CAN operate in transparent mode, I rarely used/use it. Fortinet introduced
VWire which is a layer 2 pair of interfaces. These interfaces do NOT have an IP address assigned to either of them. You cannot add VLANs to virtual wire pairs. However, you can enable wildcard VLANs for a virtual wire pair. This means that all VLAN-tagged traffic can pass through the virtual wire pair if allowed by virtual wire pair firewall policies. Essentially, it is similar to a transparent mode VDOM but better, less complex, and cleaner IMHO.
This is ONE Use Case but the possibilities are endless. Lets say you have 20 locations and they are all connected via an MPLS circuit. The remote sites are a hybrid of Trusted and Hostile sites meaning that they are known to have issues with Shadow IT.... (the ones NOT running FortiNAC, but that is a subject for a different post 😊 ). You want to make sure that you are able to run IPS against that traffic to try to protect the "soft and chewy center" of your datacenter. Lets say that the MPLS terminates at the DC on a carrier managed router. You could disconnect the router from the internal network and plug it into one side of the FortiGate VWire and then plug the other side of the FortiGate VWire to the internal network. Now you can enforce and inspect traffic as it flows from remote sites to internal and internal to remote sites.
Another Use Case, which we describe below, is blocking RDP access from the standard users. Here we will block all RDP sessions destined to the Server VLAN and permit everything else.
Configuring the VWire
You will need to create the VWire pair by going to
Virtul Wire Pair
Give it a
Name and choose the
Interface Members Note: The interfaces cannot have any configuration on them or be referenced anywhere else in the config.
If you plan on using
Wildcard VLANs select it and choose the VLANs. Enter the VLAN (e.g. 1-1024)
Never mind the selected
Wildcard VLAN as it was switched off after I added the interfaces.
You will now have a section in the
Networks | Interfaces portion of the Fortigate that will show the VWire named
Monkey-VW and the two corresponding interfaces.
The VWire policies are located in the same general area as the IPv4 Policies (or the new Policies in 6.4+) but in their own section.
The section is called
Firewall Virtual Wire Pair Policy
On the top, right hand side of the screen, you will see the name of the VWire Pair we created in the first section.
Now you can
This section is pretty much the same as what you are used to seeing whether you are running
Profile-Based modes, with this major difference; you will see the
Virtual Wire Pair instead of
incoming interface and
In this section, you will be able to create either
bidirectional policy. In our example, we are going to assume that
port9 is connected to common user PCs and
port10 is connected to the Server side.
We are going to create an address object for the
PC-Network represented by the
Above we can see the policy I am creating that will deny all the PCs in the
PC-Network from using
RDP to connect to the
SERVER-LAN. Since the policy is a
Deny we will not see any
security profiles or
Applications (In policy-mode).
In the screenshot above, we can see that all traffic from the
PC-Network (Port9) destined to
SERVER-LAN (Port10) that is
RDP (TCP 3389) will be denied. All other traffic back and forth will be permitted.
You can have multiple VWire configurations without the need for VDOMs. I use this configuration regularly. It is great to put the FortiGate between existing firewalls and internal switches or perimeter router. I love to identify traffic that "competitors" do not see.