Using a Virtual Wire Pair to Simplify Transparent Mode
|In FortiOS 5.4, virtual wire pair replaces the feature port pairing from earlier firmware versions. Unlike port pairing, virtual wire pair can be used for a FortiGate in either Transparent or NAT/Route mode.|
A virtual wire pair consists of two interfaces that have no IP addresses and all traffic received by one interface in the pair can only be forwarded out the other; as controlled by firewall policies. Since the interfaces do not have IP addresses, you can insert a virtual wire pair into a network without having to make any changes to the network.
|Interfaces used in a virtual wire pair cannot be used for admin access to the ISFW FortiGate. Before creating a virtual wire pair, make sure you have a different port configured to allow admin access using your preferred protocol.|
- Go to Network > Interfaces and select Create New > Virtual Wire Pair. Add two ports to the virtual wire pair. These ports cannot be part of a switch, such as the default internal/lan interface.
- Go to Policy & Objects > IPv4 Virtual Wire Pair Policy and create a policy will allow traffic to flow between the two ports. Give the policy an appropriate Name. Select the direction that traffic is allowed to flow. Configure the other firewall options as needed.
- If necessary, create a second virtual wire pair policy allowing traffic to flow between the ports in the opposite direction.
Traffic can now flow between the two ports. Go to FortiView > Policies to see traffic flowing through both policies.