Separate network prior to firewall installation
Separate network prior to firewall installation
The issue involves separating two networks within Company A’s infrastructure while maintaining shared internet access. The current setup uses building #1 as the internet hub, with building #2 connected via fiber through switches and an ONT. To isolate the networks, bypassing the firewall entirely isn’t recommended. Instead, consider routing traffic through a dedicated device like an EdgeRouter to manage the connection between the ONT and the firewall. This approach keeps the existing hardware functional and simplifies configuration.
It's a Fortigate 80E. Our current firewall settings would still impact us. We're unable to connect to the network in building #2, likely due to those rules. The ONT typically allows only one device at a time, but if it supports advanced features like a layer3 switch or routing, we might be able to extend connectivity to separate groups.
Routes can be configured on the Fortinet to manage multiple subnets and regulate traffic between them. Placing an L3 switch prior to the Fortinet functions similarly to adding a router, allowing the Fortinet to handle these tasks efficiently.
If it's an FG 80e, I'll generate three VDOMs. One for the WAN, one for Corp1, and another for Corp2. The WAN VDOM will connect with Corp1 and Corp2 through internal links, managing WAN IP and NAT tasks. Tag the VLANs for each CORP1 and CORP2 instance via the L2 layer, showing per-port details as required for the office layout. The FortiGate will manage traffic between CORPX and the WAN, and control whether Corp1 and Corp2 can communicate or not.
If the Fortigate remains unchanged, you must use multiple WAN IP addresses otherwise your traffic will go through their firewall. If going through the firewall is acceptable, set up a new interface and associate it with Corp2. If that setup feels too distant, consider installing a firewall with double NAT, though this may cause problems later. Ultimately, significant adjustments on the firewall are necessary to meet your requirements.
I understood the setup mentioned earlier. It seems they arranged switches after the modem but before the firewall. They likely needed multiple public IPs to support different networks. This process is unfamiliar to me since I haven’t had to separate networks before. I’m unsure if placing my own firewall between the modem and theirs is necessary, especially if I can set up the firewall first and then direct traffic through the switch for specific areas like building #2.