CloudLabBox
Try the free demo

FortiGate lab 3 of 25

Interfaces, VLANs, zones and DHCP

Split the office into Staff and Finance VLANs on one FortiGate port, serve each VLAN with DHCP (including a reservation), group the VLANs in a zone and control the traffic between them.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 7,168 MB in total. That fits the free demo too.

In your workspace: Shared, then FortiGate NSE 4 guided labs, then 03 - Interfaces VLANs zones and DHCP

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Beginner
Time
About 60 minutes
Nodes need
6 vCPU, 7,168 MB
Smallest plan
Lite

The scenario

Finance wants its own network: the auditors don't want finance PCs on the same broadcast domain as everyone else. The office switch (SW1) already carries two VLANs to FGT1 on one cable: VLAN 10 for Staff and VLAN 20 for Finance. Your job is the FortiGate side: a gateway and DHCP for each VLAN, a fixed address for the Finance workstation H2, internet access for both, and a rule that lets Staff ping Finance but not the other way round.

DeviceInterfaceAddressConnects to
FGT1port1 (ISP-A)203.0.113.1/24INET, gateway 203.0.113.254
FGT1port2no address (802.1Q trunk)SW1 Gi0/0 (VLANs 10 and 20)
FGT1VLAN10 (you create it)10.1.10.1/24Staff: PC1 10.1.10.10, H1 by DHCP
FGT1VLAN20 (you create it)10.1.20.1/24Finance: H2, reserved 10.1.20.50
SW1Gi0/1, Gi0/3 / Gi0/2access VLAN 10 / VLAN 20H1, PC1 / H2

Topology: INET above FGT1; SW1 below it on one trunk; H1 and PC1 in VLAN 10, H2 in VLAN 20.

What you’ll practise

  • Create 802.1Q VLAN interfaces on a FortiGate port that trunks to a switch
  • Run a DHCP server per VLAN with a domain name and a MAC reservation
  • Group interfaces in a zone and decide what intra-zone traffic may do
  • Write policies that allow internet access for both VLANs and one-way access between them
  • Explain why stateful inspection lets replies return without a reverse policy

The tasks

  1. Start the lab
  2. VLAN interfaces on the trunk
  3. DHCP for each VLAN
  4. A reservation for the Finance workstation
  5. A zone for the internal VLANs
  6. One-way access between the VLANs
  7. Look at the interfaces and leases

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Interfaces VLANs zones and DHCP6 nodes, 5 links. Every link is listed as text below the diagram.FGT1SW1INETPC1H1H2port2Gi0/0port1eth0Gi0/1eth0Gi0/2eth0Gi0/3eth0
6 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • FGT1 port1 to INET eth0
  • FGT1 port2 to SW1 Gi0/0
  • SW1 Gi0/1 to H1 eth0
  • SW1 Gi0/2 to H2 eth0
  • SW1 Gi0/3 to PC1 eth0
Nodes in Interfaces, VLANs, zones and DHCP, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
FGT1Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
SW1Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 1,024 MB
INETEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
PC1EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 2,048 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
H2Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder FortiGate NSE 4 guided labs.

  3. Open 03 - Interfaces VLANs zones and DHCP and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More FortiGate labs

All FortiGate labs

Related labs in other courses

CloudLabBox is independent of Fortinet. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.