FortiGate is operating in NAT mode and is configured with two virtual LAN (VLAN) subinterfaces added to the same physical interface. In this scenario, what are two requirements for the VLAN ID? (Choose two.)
A.
The two VLAN subinterfaces can have the same VLAN ID, only if they have IP addresses in the same subnet.
B.
The two VLAN subinterfaces can have the same VLAN ID, only if they belong to different VDOMs.
C.
The two VLAN subinterfaces must have different VLAN IDs.
D.
The two VLAN subinterfaces can have the same VLAN ID, only if they have IP addresses in different subnets.
Anything but the "different VLAN" answer is impossible from a networking view, as well as configuration on the FG is concerned. At least up to 7.0 it's impossible to configure the same VLAN on the same physical link multiple times, no matter if it's in separate VDOMs or not.
P.S. - did some tests - at least up to 7.0.12, the firewall will instantly complain about duplicate VLAN ID no matter if you select different VDOMs, IPs, or IPs from the same subnet (which will ADDITIONALLY cause an IP-conflict with the first VLAN interface)
So, if the official test has this question and asks for two choices, it's definitely wrong ... (as any sane technician would argue)
t is C and D. But to achieve this monstrosity you have to implement 802.1Q and 802.1AD vlans and they need to be in different subnets.
And yes this is still mind boggling.
I used my own lab to resolve this question:
If you use the same VLAN ID to add a second subinterface to the same physical interface is not allowed you get the error (
VLAN ID used by another VLAN switch) unless you change the VLAN Protocol to 802.1AD, no matter the VDOM you assign the subinterface.
Being said that, options A and B are not true, the option C is correct and option D is true if as I said before you use 802.1Q in one subinterface and 802.1AD in the second subinterface.
On other websites, this question only requests a single answer. B and D can be done using a different vlan type,but that's because it's Q in Q tunneling, so it's not really a vlan interface.
c,D
In a scenario where FortiGate is operating in NAT mode and configured with two virtual LAN (VLAN) subinterfaces added to the same physical interface, the correct requirements for the VLAN ID are:
C. **The two VLAN subinterfaces must have different VLAN IDs.** Each VLAN subinterface should have a unique VLAN ID to properly segregate traffic between VLANs.
D. **The two VLAN subinterfaces can have the same VLAN ID, only if they have IP addresses in different subnets.** If two VLAN subinterfaces share the same VLAN ID, they must belong to different IP subnets to avoid IP address conflicts and ensure proper routing of traffic.
So, options C and D are the correct requirements for the VLAN ID in this scenario.
VLANs split your physical LAN into multiple, logical LANs. In NAT operation mode, each VLAN forms a
separate broadcast domain. Multiple VLANs can coexist in the same physical interface, provided they have
different VLAN IDs. In this way, a physical interface is split into two or more logical interfaces. A tag is added
to each Ethernet frame to identify the VLAN to which it belongs.
Note that in a multi-VDOM environment, the physical interface and its VLAN sub-interface can be in separate
VDOMs.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Garry_G
Highly Voted 1 year, 6 months agoGarry_G
1 year, 1 month agoBungee75
4 months, 1 week agoerawemk
Highly Voted 1 year, 4 months agoOzzygate
Most Recent 3 months agoAJMD
4 months, 4 weeks agoGasimovTofig
5 months, 1 week agolearner2024
5 months, 2 weeks agoGopiChandMurari
5 months, 3 weeks agoMAUROBTA
7 months, 1 week agoMAUROBTA
7 months, 1 week agoBosubw
7 months, 1 week agoGoodServant
7 months, 1 week agoznznzn219
9 months, 2 weeks agoGeniusA
10 months, 2 weeks agoTheManDude
11 months, 1 week agoDiego_Farani
11 months, 3 weeks agokeshzy
1 year agonazareth
1 year ago