system v-zone
Use this command to configure bridged network interfaces, also called v-zones.
Bridges allow network connections to travel through the FortiWeb appliance’s physical network ports without explicitly connecting to one of its IP addresses.
To use this command, your administrator account’s access control profile must have either w or rw permission to the netgrp area. For details, see Permissions.
Syntax
config system v-zone
edit "<bridge_name>"
set interfaces {"<interface_name>" "<interface_name>" ...}
set monitor {enable | disable}
set mtu <mtu_int>
set use-interface-macs {"<interface_name>" "<interface_name>" ...}
set multicast-snooping {enable | disable}
set wildcard-vlan {enable | disable}
set vlan-filter <range>
next
end
|
"<bridge_name>"
|
Type the name of the bridge. The maximum length is 15 characters.
To display the list of existing bridges, type:
edit ?
|
No default. |
|
interfaces {"<interface_name>" "<interface_name>" ...}
|
Type the names of two or more network interfaces that currently have no IP address of their own, nor are members of another bridge, and therefore could be members of this bridge. Separate each name with a space. The maximum length is 63 characters. |
No default. |
|
mtu <mtu_int>
|
Enter the maximum transmission unit (MTU) that the bridge supports.
When you specify the MTU for a bridge, FortiWeb automatically sets the MTU for the v-zone members to the same value.
Valid values are 512–9216 (for IPv4) or 1280–9216 (for IPv6).
|
1500
|
|
multicast-snooping {enable | disable}
|
Enable/disable multicast snooping.
|
No default |
|
monitor {enable | disable}
|
Specifies whether FortiWeb automatically
brings down all members of this v-zone if one member goes down. |
disable
|
|
use-interface-macs {"<interface_name>" "<interface_name>" ...}
|
Enter the names of network interfaces that are members of the bridge and send and transmit traffic using the MAC address of their corresponding FortiWeb network interface.
When the operation mode is True Transparent Proxy, by default, traffic to the back-end servers preserves the MAC address of the source. If you are using FortiWeb with front-end load balancers that are in a high availability cluster that uses multiple bridges, this mechanism can cause switching problems on failover. When the v-zone uses the MAC address of the FortiWeb network interface instead, a failover does not interrupt the flow of traffic.
Available only when the operation mode is True Transparent Proxy. |
No default. |
|
wildcard-vlan {enable | disable}
|
If enabled, FortiWeb can handle double-tagged VLAN traffic, single-tagged VLAN traffic, and non-tagged traffic simultaneously, providing greater flexibility for complex service provider or enterprise network deployments.
-
This feature is only functional when FortiWeb is operating in True Transparent Proxy mode.
-
This feature is currently supported only in High Availability Active-Passive (AP) clusters.
-
This feature is exclusively supported via the CLI on specific F-series platforms and their high-speed physical ports:
-
1000F: Ports 13 and 14.
-
2000F: Ports 9, 10, 11, and 12.
-
3000F: Ports 1 through 10.
-
4000F: 10G ports 1-12 and 40G ports 1-2.
Note: Once enabled for a v-zone entry, it cannot be disabled; to revert this setting, you must delete and recreate the v-zone entry.
|
disable
|
|
vlan-filter <range>
|
Defines the range of allowed VLAN IDs (e.g., 100-200 or 10, 20, 30). When this filter is unset, it allows all VLAN traffic.
|
No default.
|
Example
This example configures a true bridge between port3 and port4. The bridge has no virtual network interface, and so it cannot respond to pings.
config system v-zone
edit bridge1
set interfaces port3 port4
next
end
Related topics
