Troubleshooting Tip: Forwarding the VLANs through Virtual Wire Pair

Description

This article describes how to troubleshoot when the Virtual Wire Pair is being configured but the VLANs are not passing through it.

Scope

FortiGate.

Solution

With the Virtual Wire Pair the FortiGate can be configured as transparent mode and the firewall will only be used for inspecting traffic for correspondent VLAN and providing security. The Virtual Wire Pair configuration method can be found in this KB article: Technical Tip: Virtual wire pairs. 

Once the firewall is configured for passing the VLANs but it is not passing them, it is mandatory to check if the VLAN forwarding is enabled or not. 

 
The default setup of the 'vlanfoward' is 'disable' in the correspondent interface.

Once the VLAN forward is enabled in the interfaces that are the members of the Virtual Wire Pair, VLANs will be forwarded through and the traffic will be passed according to the wire pair policy.

Note:
Enabling wildcard-vlan in virtual-wire-pair also enables vlan-forwarding inside the physical interfaces by default.