Link to home
Start Free TrialLog in
Avatar of CORPORAT
CORPORAT

asked on

Routing Traffic from INTERNAL to a VLAN on Fortigate 100A

Hello,

I'm having a problem with setting up a new test lab with a new VLAN.

We have a Fortigate 100A, an internal interface of 192.168.15.0/24.

The new VLAN ID is 50 and the subnet is 192.168.50.0/24 and i've set it up as a new vlan interface

Policy routes were setup to go from one to the other, and vice versa. Policy routes were setup as well to go from one to the other.

There is a Cisco switch in between which was setup with a VLAN50, and one port was setup as an access port for VLAN50.

I can ping TO the INTERNAL network from the new VLAN50, but I cannot print FROM the INTERNAL network to the new VLAN50, no matter what device, nor can I ping the 192.168.50.1 gateway from the internal network.

I've tried playing with the different settings, etc, but can't figure it out.
SOLUTION
Avatar of rauenpc
rauenpc
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of CORPORAT
CORPORAT

ASKER

Sorry!

A port on the Cisco switch was set as an access port for vlan 50, that is where i'm connecting the laptop into.

The cisco switch is uplinked to the fortigate 100A's internal switch port#2 via a trunk port on the cisco switch. Other VLAN traffic passes fine directly to the internet, but this is the first time i've needed to do interVLAN traffic (that's not VPN related).
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Rausenpc,

- The fortigate is setup with an internal interface, that's 192.168.15.0/24. The VLAN is VLAN 50, 192.168.50.0/24.
- Firewall policy rules allowing all traffic from 192.168.15.0 to 192.168.50.0 and vice versa setup.

- Yes, VLAN 50 was added to the Cisco 3560 with the VLAN 50 command, I even had labeled it with a name
- Yes, VLAN50 is allowed on the trunk between the fortigate 100A and the cisco 3560 switch.

- We can ping from the a device on the 192.168.50.0 network TO the 192.168.15.0, but cannot ping in reverse.

- We ran pings and did two packet sniffers on the fortigate, and can see the fortigate getting the ping traffic from the 192.168.15.0 side hitting the fortigate @ 192.168.15.1, but it doesn't make it to the 192.168.50.0 side.

It looks like it's the fortigate that's the issue here, i'm just wondering what is wrong or if we're doing something wrong.

Fortigate 100A
- Added VLAN interface of 192.168.50.0/24
- Setup DHCP server for 192.168.50.100 - 150
- Setup firewall policy to allow traffic between existing "INTERNAL" network and the new 192.168.50.0 network, in both directions
- Tried policy routes, tried static routes, the router monitor shows the 192.168.50.0 network as directly connected, just can't understand why traffic isn't routing from 192.168.15.0 to 192.168.50.0 network.
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
I had thought that might be the case, but no, I completely disabled the software firewalls, and even tried a second machine.

Also, another strange behavior, I can ping 192.168.50.1 from the 192.168.15.0 network, but not any other IP on the 192.168.50.0 network!

Windows clients don't get the 192.168.50.0 network route advertised automatically either.

We tested with another VLAN, and if we set it all up exclusively on the switch. Once the fortigate gets introduced as the router, it becomes a problem.

The 3560 is not doing any routing whatsoever, it's just being used as a switch.
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Thanks guys, I got it working with Fortigate support but the correct solution is to create a new VLAN and migrate everything from INTERNAL to it, then this would have been easy.