Fortinet FortiGate FortiGate-500A, Руководство администратора

Страница: 63 / 394

System network VLAN overview
FortiGate-500A Administration Guide 01-28006-0100-20041105
63
Figure 14: Basic VLAN topology
FortiGate units and VLANs
In a typical VLAN configuration, 802.1Q-compliant VLAN layer-2 switches or layer-3
routers or firewalls add VLAN tags to packets. Packets passing between devices in
the same VLAN can be handled by layer 2 switches. Packets passing between
devices in different VLANs must be handled by a layer 3 device such as router,
firewall, or layer 3 switch.
Using VLANs, a single FortiGate unit can provide security services and control
connections between multiple security domains. Traffic from each security domain is
given a different VLAN ID. The FortiGate unit can recognize VLAN IDs and apply
security policies to secure network and IPSec VPN traffic between security domains.
The FortiGate unit can also apply authentication, protection profiles, and other firewall
policy features for network and VPN traffic that is allowed to pass between security
domains.
VLAN Switch or router
Internet
VLAN 1
VLAN 2
VLAN 1 network VLAN 2 network
VLAN trunk
POWER
VLAN 1
VLAN 2
Firewall or
Router
Esc Enter
Untagged
packets