Troubleshooting Tip: VLAN 1 sub-interface is not working over a trunk link

Description

This article describes an issue where a FortiGate sub-interface configured with VLAN 1 does not receive traffic.

Scope

FortiGate, third-party switch.

Solution

The issue occurs because most switches treat VLAN 1 as the native (untagged) VLAN on trunk links.

FortiGate, however, requires VLAN 1 traffic to be tagged on its sub-interface, and untagged traffic will be sent or received on the physical interface.

This mismatch prevents traffic from reaching the FortiGate unless the switch configuration is adjusted.

Workarounds:

1. Change the native VLAN on the switch to a dummy VLAN (for example, VLAN 999), which is a VLAN not used anywhere else in the network. This ensures VLAN 1 traffic is sent as tagged across the trunk.

config terminal
    interface gi0/1
    switchport mode trunk
    switchport trunk native vlan 999
    switchport trunk allowed vlan 1,10,20

2. To keep VLAN 1 as the native (untagged) VLAN on the switch, avoid creating a VLAN 1 sub-interface on the FortiGate. Instead, assign the IP address, routing, and DHCP settings directly to the physical parent interface connected to the switch. The physical port natively processes the untagged frames from the switch.

There are limitations to consider with the usage of specific VLANs. Using VLAN ID 1 should be avoided in configurations. For more information, see Technical Tip: Special/Reserved VLAN IDs on the FortiGate.

Note: FortiGate requires all VLAN sub-interfaces - including VLAN 1 - to receive 802.1Q-tagged frames for proper operation.