Fortigate Hardware switch, Software switch, VLAN switch

on

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Hardware-switch-Software-switch-VLAN-switch-Use/ta-p/210153

Hardware Switch 

Processing on dedicated switching hardware, not CPU.

Only allowed physical interfaces


'HW Switch' which was initially of 'Hardware Switch' type is now showing as 'VLAN Switch' after enabling 'VLAN Switch'

example:

Fortigate70F, out of box, all 5 LAN ports in VLAN switch type interface call internal 







in CLI, it shows as hardware switch 

FortiGate-70F # config system interface

FortiGate-70F (interface) # edit "internal"

FortiGate-70F (internal) # show
config system interface
    edit "internal"
        set vdom "root"
        set ip 10.20.20.1 255.255.255.0
        set allowaccess ping https ssh fgfm fabric
        set type hard-switch
        set alias "LAN"
        set stp enable
        set role lan
        set snmp-index 15
    next
end

FortiGate-70F (internal) #

Multiple VLAN switches can be created.


Fortigate 60E v7.2

All interface (internal1-interface7) by default in Hardware Switch called internal


Software Switch

Processing in CPU. Lower performance compare to hardware switch.

Member can be Physical interface, VLAN interface, SSID, and VXLAN/GRE/IPsec tunnel interfaces.


Software-switch has a few extra options like can act as Hub


Recommended- Hardware switch use less resources, but less flexible in setup.


VLAN Switch

Essentially a variant of the hardware switch, tied to specific chassis with an ISF (Integrated Switch Fabric).

Nearly identical to a hardware switch, but adds two extra capabilities: the ability to set a VLAN tag on the switch itself (like a native/untagged VLAN on a normal switch port), and the ability to pair with an Ethernet Trunk interface so that VLAN traffic can be propagated to an external switch or a redundant/HA-paired FortiGate.


Practical takeaway: if your FortiGate model has an ISF and you just need to bridge a handful of physical ports on the same subnet, use a hardware switch for best performance. If you additionally need native VLAN tagging or trunk propagation to another switch/HA peer, use a VLAN switch. If you need flexibility — mixing VLANs, tunnels, or wireless SSIDs into one L2 domain, or you're on a model/VM without ISF support — use a software switch, accepting the CPU-bound performance trade-off.





Comments

Post a Comment