In many small offices every device – computers, printers, cameras, guests’ phones – sits on one network. If one of them is compromised, the attacker can reach the accounting PCs and the server directly. VLANs split the network into parts, and FortiGate decides with firewall policies who can reach what.
Why segment the network
- A hacked IP camera or smart TV cannot see computers or files, because there is no policy from its VLAN to them.
- Guests get internet only and see no office devices.
- Ransomware spreads quickly on a flat network; segmentation limits the damage.
- Traffic becomes visible: FortiGate logs traffic between VLANs and can inspect it with security profiles.
Typical VLAN plan for a small office
| VLAN ID | Name | Subnet (example) | For | Access |
|---|---|---|---|---|
| 10 | STAFF | 10.0.10.0/24 | Staff computers | Internet, printers, servers |
| 20 | SERVERS | 10.0.20.0/24 | Server, NAS | Only required ports from STAFF |
| 30 | PRINT-IOT | 10.0.30.0/24 | Printers, cameras, screens | Cannot initiate connections to STAFF |
| 40 | VOICE | 10.0.40.0/24 | IP phones | Internet, phone system |
| 50 | GUEST | 10.0.50.0/24 | Guests | Internet only |
The numbers and addresses are examples; what matters is that the plan is documented and the subnets do not overlap with home offices or VPN networks.
Creating VLANs and assigning ports
FortiSwitch connects to FortiGate over FortiLink and is managed directly from the FortiGate (WiFi & Switch Controller → Managed FortiSwitches).
- Open WiFi & Switch Controller → FortiSwitch VLANs and choose Create New.
- Enter a name and the VLAN ID; the interface is the FortiLink interface.
- Set the FortiGate IP address in that VLAN (this is the devices’ default gateway) and enable DHCP Server.
- Under Administrative Access allow only what is needed – the guest and IoT VLANs must not have HTTPS or SSH.
- Repeat for each VLAN.
Then open WiFi & Switch Controller → FortiSwitch Ports. Each port has two important fields:
- Native VLAN – the untagged VLAN. On a port for an ordinary PC, printer or camera this is the device’s VLAN, e.g. PRINT-IOT on a printer port.
- Allowed VLANs – tagged VLANs. You need these e.g. on a port with a FortiAP serving several SSIDs, or for an IP phone with a PC behind it (phone on VOICE tagged, PC on STAFF native).
Add a description to ports (“Printer 2nd floor”) so it is clear later what is connected where. Put unused ports into a separate empty VLAN or disable them.
Policies between VLANs
Traffic between VLANs passes through the FortiGate, so it is blocked until you add a policy under Policy & Objects → Firewall Policy:
- STAFF → internet and STAFF → PRINT-IOT (e.g. printing ports only);
- STAFF → SERVERS with only the services needed (e.g. SMB, RDP);
- GUEST → internet, with no policy to the internal network at all;
- PRINT-IOT → internet only if the device really needs it (firmware updates, cloud service).
You can also use NAC Policies (WiFi & Switch Controller → NAC Policies) to place a device automatically into the right VLAN, for example by vendor or MAC address, and 802.1X port security so that unknown devices cannot join the network.
Common mistakes
- An “all → all” allow policy between VLANs – then segmentation is pointless.
- A printer or scanner becomes undiscoverable after moving VLAN, because mDNS/broadcast does not cross VLANs; add the printer to computers by IP address.
- SSID VLANs not added to Allowed VLANs on the FortiAP port.
- Admin access (HTTPS, SSH) enabled on the guest or IoT VLAN.
- Changes made during working hours without a fallback plan – a wrong native VLAN can cut off a whole floor instantly.
When to call a professional
If the network includes a server, IP phones or many different devices, review the VLAN plan with a specialist before making changes and do the migration outside working hours. ITABIKS sets up FortiGate and FortiSwitch solutions; call +372 53 888 229.