We utilize Fortigate vdoms for many school districts. Currently, as recommended by Fortigate, we extend the school vlans across our WAN. The vlans become virtual interfaces on the Fortigate vdom which firewall policies are applied to. This works very well for us but, recently, this design caused issues on our WAN because of LAN issues at one of the districts bleeding over to the WAN. The solution we are currently implementing is to create a single, transient vlan and route all other vlan subnets through it to the Fortigate. This works for simple configurations but is not a viable solution for complex Fortigate configurations. The best solution would allow us to extend the district layer 2 vlans across a layer 3 connection and then pick up the vlan again at the Fortigate so it can be used as a virtual interface with the same subnet as what is used at the school district. (See drawing) .
The switches we are currently using are Aruba 3810s
What options are available in this scenario?
Thank you for assistance!