mikrotik ccr and fortigate firewall policy

RouterOS General
1

Hello,
i have a mikrotik CCR1036 2s±em and it works as router and i connected a cisco 3750 to this router. now we want add a new firewall in this network and connect a port from firewall to switch or router and pass some /32 or less throu firewall device, how can i do it?
i know i can do static route a prefix to firewall and create vlan there then in switch access vlan to that VLANID to that port, but we have some VLANs that created in mikrotik CCR and we can not move all ips traffic thro firewall. we want move traffic for some ips in that vlan thro that firewall
any idea?
thanks

2

Hi! Can you attach a scheme of your net and your plan?


Yours respectfully!

3

hi,
please check attachment , this is my net diagram.
and i know i can connect fortinet to my core switch then static route my prefix to foritnet and create vlan on it then in my switch access to that vlan for that port,
but i need to all of my vlans created in mikrotik,
thanks

4

You can move traffic by mangle in any needed gateway. Can you?


Yours respectfully!

5

with mangale i can manage receive packets what about sent packets? those packets generate by my devices will go throu router directly, because they have my router as gateway

6

You can mangle new gateway IP


Yours respectfully!

7

Hi
In mu 3750 i should add mangle for that right?
Can you give me some example for in and out ?

8

and is there any other way except mangle?

9

Maybe you need create a bridge on ccr, then add a wan port of provider and wan port of fortigate uplink, then you only assign needed external addr to fortigate? But, if you create a bridge, then all ip config need be at bridge interface, not at physical port.


Yours respectfully!

10

there is an idea that create a mangle for incoming traffic that set fortinet as gateway and in ccr create another mangle for that src ips orginate from my network for set next hop to fortinet ,
in this way the only issue is for outgoing traffic first they travel to mikrotik then i set next hop to fortinet and then fortinet again set enxt hop to mikrotik and goes out of my router, is this way correct and logical?

11

If you need put a fortigate to WAN side-create a wan bridge. Its may works. Can you put scheme with traffic directions?


Yours respectfully!

12

If you need put a fortigate to WAN side-create a wan bridge. Its may works. Can you put scheme with traffic directions?


Yours respectfully!