A substation has protection-relay traffic and status-monitoring traffic arriving over a single physical uplink cable to the FortiGate, and the utility's network team wants each traffic type on its own logical interface so separate firewall policies and IP subnets can apply, without running additional cabling. Which interface type should they create on top of the existing physical port?

A VLAN subinterface lets a single physical port carry multiple logically separated Layer 2 segments by tagging frames with an 802.1Q VLAN ID. The FortiGate creates a distinct interface object for each VLAN, and each one can be assigned its own IP subnet, be placed in a different zone, and be matched by its own firewall policy — which is exactly the separation the substation needs between relay and status traffic without adding physical ports or cabling. A software switch is the wrong tool here because it merges multiple physical (or VLAN) interfaces into one broadcast domain behind a single logical interface, which collapses separation rather than creating it. A static route only affects where traffic is forwarded once it has already arrived on an interface — it does nothing to split incoming untagged traffic into separate logical segments. A loopback interface is a virtual, always-up interface typically used for management access or routing protocol stability, not for segmenting traffic on a physical link. To verify the configuration, check that the upstream switch port is set to trunk mode carrying the matching VLAN IDs, since a VLAN subinterface with no matching trunk configuration on the switch will never see tagged frames.