NetCrosswalk: Cross-Vendor Network Task Translator

Steps

1. Router-on-a-stick VLAN interfaces: GUI Interfaces → VLAN tab, or CLI /interface vlan print.
2. Bridge VLAN-filtering table (per-port tagged/untagged membership): GUI Bridge → VLANs tab, or CLI /interface bridge vlan print.
3. Detailed membership for one VLAN: /interface bridge vlan print detail where vlan-ids=10

Gotchas & notes

• These are two separate tables and neither shows the other's data — /interface vlan print only lists router-on-a-stick sub-interfaces, /interface bridge vlan print only lists the bridge's tagged/untagged port table. A VLAN built the bridge-filtering way will not appear in /interface vlan print at all, which looks like it is missing when it isn't.
• The bridge VLAN table's current-tagged/current-untagged columns (vs plain tagged/untagged) show what hardware offload actually programmed, which can differ from the configured list on CRS switch-chip models — check current-* when troubleshooting, not the config columns.
• /interface vlan print shows the sub-interface and its parent, but not IP addressing — cross-reference /ip address print for that.

Steps

1. GUI: Network → Interface. VLANs are not a separate menu item — they're listed as sub-rows nested under their parent physical port. Click the + next to a port to expand it.
2. The VLAN ID column is hidden by default. Click the column-settings icon on the table header (or right-click a header) and enable it to see every VLAN's tag at a glance instead of opening each one.
3. CLI, kernel-level view of every interface including VLANs: diagnose netlink interface list
4. CLI, config-level view with VLAN ID and parent explicitly shown: config system interface → show (scan the output for set type vlan blocks — each has its own set vlanid and set interface <parent> lines)

Gotchas & notes

• This is the single most common 'I can't find it' moment on FortiGate — there is no Network → VLANs page. A VLAN is just an interface object with type vlan, so it lives in the same list as every physical port, and the one column that would make it obvious (VLAN ID) is off by default.
• diagnose netlink interface list dumps literally every kernel interface (physical, aggregate, VLAN, tunnel, loopback) with no filtering — on a box with many VLANs this is a lot of scrolling; the GUI with the VLAN ID column added is usually faster once it's set up once.
• A VLAN interface's name does not have to contain its VLAN ID or match its parent's name — show system interface is the only fully reliable way to confirm the actual tag, never trust the interface name alone.
• FortiSwitch-side VLANs (FortiLink-managed) are a separate thing entirely — see WiFi & Switch Controller → FortiSwitch Ports for those, not Network → Interface.

Steps

1. Settings → Networks. Every defined Network is listed with its VLAN ID in the summary row.
2. Click a Network to see its subnet, DHCP range, and which switch port profiles reference it.
3. To see tagging on a specific switch instead: Devices → <switch> → Ports, each port shows its Native VLAN/Network and tagged VLAN list.

Gotchas & notes

• This is the one platform here with a genuinely obvious, single list — Settings → Networks is unambiguous about which VLAN IDs exist sitewide.
• A VLAN ID existing under Settings → Networks does not mean any port is actually carrying it — check the port profile on each switch separately if traffic isn't passing.
• There is no per-device CLI view of this that matches the controller's list; the controller's database is the only source of truth.

Steps

1. show vlan brief — the standard one-shot view: VLAN ID, name, status, and assigned access ports.
2. show vlan (no brief) adds per-VLAN type (Ethernet/FDDI/Token Ring — Ethernet in practice), MTU, and SAID/STP info.
3. Trunked VLANs on a specific uplink: show interfaces trunk (shows allowed, active, and forwarding VLAN lists per trunk — three different columns, often different from each other).
4. SVIs specifically: show ip interface brief | include Vlan

Gotchas & notes

• show vlan brief only lists access port membership — a VLAN that exists only on trunk links with no access ports shows an empty port list, which looks unused even when it's actively carrying trunked traffic. Check show interfaces trunk too before assuming a VLAN is dead.
• show interfaces trunk's three VLAN lists mean different things: *allowed* is the configured list, *active* is allowed minus any VLAN not in the VLAN database, *forwarding* is active minus anything STP is blocking on that port. A VLAN missing from *forwarding* but present in *allowed* is a spanning-tree, not a config, problem.
• A VLAN can exist in show vlan brief with no SVI at all — that's normal for a pure Layer 2 VLAN with routing handled elsewhere. Absence from show ip interface brief doesn't mean the VLAN is missing.

Steps

1. Tagged Layer 3 sub-interfaces (the common case — router-on-a-stick style): Network → Interfaces → Ethernet, the Tag column shows each sub-interface's VLAN. CLI: show interface all (sub-interfaces appear as ethernet1/2.10 etc. with their tag).
2. VLAN objects used for Layer 2/virtual-wire bridging: Network → VLANs (this page only lists VLAN objects, not tagged sub-interfaces). CLI: show vlan all.

Gotchas & notes

• These are two unrelated VLAN concepts on PAN-OS and the GUI keeps them on separate pages. A tagged Layer 3 sub-interface (what most people mean by 'a VLAN') will not appear under Network → VLANs at all — that page is only for the Layer 2 VLAN object type. Looking in the wrong one is the most common confusion here.
• show vlan all returns nothing on a pure Layer 3 deployment with no VLAN objects defined — that's expected, not a sign anything is broken.
• The Tag number and the sub-interface name suffix are independent; always read the actual Tag column/CLI field rather than assuming ethernet1/2.10 means tag 10.

Steps

1. Interfaces → VLANs — the single dedicated page listing every VLAN tag, its parent interface, and description.
2. To see which of those VLANs are actually assigned and configured as usable interfaces: Interfaces → Interface Assignments.
3. For per-VLAN IP/status once assigned: Interfaces → <name> or the dashboard's Interfaces widget.

Gotchas & notes

• pfSense is the cleanest of the eight here for this task — one page, nothing hidden, nothing nested.
• A VLAN listed on Interfaces → VLANs is not necessarily doing anything yet: it has to also appear in Interface Assignments and be enabled before it passes traffic. The VLANs page alone will overstate what's actually active.
• Deleting a VLAN here while it's still assigned to an interface is blocked — unassign it first, which is a reasonable safety rail but confusing if you don't know to look for it.

Steps

1. Network → Interfaces — VLAN sub-interfaces are listed nested underneath their physical parent port in the same table used to configure them (there is no separate VLANs page).
2. Each VLAN row shows its tag, zone, and IP assignment directly in that table — no need to open the edit dialog just to see the tag.
3. CLI: show interface <parent>.<vlan-id> (e.g. show interface X0.10) shows one VLAN at a time; there is no CLI command that lists all VLAN sub-interfaces in a single table.

Gotchas & notes

• Same shape of gotcha as FortiGate: no dedicated VLAN page, VLANs are just interface rows nested under their parent in Network → Interfaces.
• SonicOS's CLI is secondary and incomplete here — unlike Cisco's show vlan brief, there's no one-shot CLI listing. The GUI table is the practical source of truth for 'what VLANs exist.'
• A VLAN sub-interface nested under a PortShield-grouped parent is not possible — PortShield ports are untagged-only (see the access/trunk task) — so every VLAN row you find here has a non-PortShielded physical port as its parent.

Steps

1. GUI (Insight, centralized): Organization → Network → VLAN lists every VLAN ID/name defined for the org, independent of which switches have actually been provisioned with it.
2. GUI (local switch): VLAN → 802.1Q VLAN → VLAN Configuration lists VLAN IDs/names defined on that switch; VLAN Membership shows the per-port Tagged/Untagged/blank grid for a selected VLAN.
3. CLI, Smart Switch Lite CLI: show vlan.
4. CLI, fully-managed M4200/M4300 (Cisco-IOS-like): show vlan or show vlan brief.

Gotchas & notes

• A VLAN defined centrally in Insight is not automatically present on every switch — Insight's list and a given switch's local VLAN database are two different things that don't sync automatically; a switch left in standalone mode or not yet claimed into that network won't show the VLAN locally even though Insight lists it.
• Insight-managed routers and Orbi Pro APs have no local VLAN list at all to check — the Insight portal is the only place that information exists for those devices.
• The Lite CLI's show vlan output is intentionally minimal compared to the M4200/M4300's Cisco-style output — don't expect per-VLAN port-membership detail from a Smart Switch's CLI the way you'd get from show vlan brief on the fully-managed line.