New Member

Question

Creating Fortigate subnets vLAN's for VMWare hosts.

Forum|Forum|9 years ago
February 26, 2017
4 replies
12078 views

Hello,

I am new to Fortigate and I am sure I am missing something here. To be honest, not even sure wether it is a Fortigate or VMWare problem.

Here is my case: My Fortigate 60D is directly connected to two vmware 6.x hostservers. Not using any another physical switch, just the internal 7+1 hardware ports switch on the Fortigate.

On the VMWare hostservers there need to be separate networks. So I choose to use 172.16.0.0 (255.255.255.224) giving me about 23 possible subnets with 30 hosts, like this;

subnet 0 255.255.255.224 172.16.0.1 - 172.16.0.30 subnet 4 255.255.255.224 172.16.4.1 - 172.16.4.30 subnet 8 255.255.255.224 172.16.8.1 - 172.16.8.30 and so on.

So the internal Fortigate interface (and gateway) is set to 172.16.0.30. The subnets 4,8, and 12 were created as vLAN's. On the vmware server I use a standard virtual switch. Subnet 0 is used for the internal hardware (server NIC's, HP ilo port, storage server and so on.) A firewall object and security policy was created for this subnet. Al hosts are able to commicate witheach othe and to the outside world. This works fine.

For the other subnets different vlan's (port groups in vmware terminology) are created. In each subnet I used the last (.30) address as the default gateway for that particular subnet. These VM's are able to communicate with each other but not to the outside world. Created a Firewall object and Policy for these subnets, on the same way I did that for the internal network 0. But only the internal subnet 0 is able the reach the outside world.

Now what am I missing here? Is this even possible without an extra switch?

I hope someone is able to see the problem. Thanks in advance.

Eric Loderichs

tanr

New Member

FortiGate vlan interfaces only work with vlan tagged packets. On the VMWare side, are the actual physical nics on your vmware host properly configured to pass the 802.1Q vlan tags? And to receive vlan tagged packets? How that's done seems to be a little different for every vendor, and to use slightly different terminology.

Assuming your vlan tags are getting sent through from the VMs, and should be received okay by the VMs, how is your FortiGate set up, and what version of FortiOS do you have?

On the FortiGate you've got multiple vlan interfaces created, with the proper VLAN ID, on top of the correct physical interfaces? And whatever IP you've listed for the vlan interfaces is set to be the default gateway for that interface from your VM side?

Assuming all that is the case, and that your vmware subnets match the subnets they need to talk to on the FortiGate, how about a simple test.

Before you dig into issues with security policy rules, DHCP, DNS etc., can you turn on *only* administrative access PING for one of the vlan interfaces, then try to ping the vlan's IP from a VM that should be able to access that vlan? That should let you make sure that you're at least getting to the FortiGate from the VM.

eloderichsAuthor

New Member

Hello tanr,

Thanks for the reply. Glad to hear that what I want is possible. Let me update;

1. Physical nics vmnic0 and vmnic1 are the onboard nics on my HPDL360G6 hostservers. I can see that the driver is " bnx2 ". But after a lot of research I 'm not sure 802.1q vlan tags are supported by these nics. Presume they will but keep looking for more info.

2. Fortigate setup. Operating mode is NAT. A VLAN VM Network 4 (172.16.4.1/255.255.255.224) was created under the wan1 interface as (public IP) well as under the internal network 172.16.0.30/255.255.255.224) both without result. Used the exact phrase in VMWare als in the Fortigate "VM Network 4".

- Firewall object "VM Network 4" Interface Any. Type subnet

- Policy VM Network 4 - wan: Source all, Destination all, schedule always, http+ https, Ping

3. FortiOS. Firmware version is v.50, build310 (GA Patch 11)

4.On the FortiGate I have multiple vlan interfaces created, with the proper VLAN ID. Used the physical wan 1 interface as well as the internal physical interface, both without result, should be wan I presume. After initally using the first IP in tht subnet I later changed it to the .30 number which is used as the gateway for that subnet. No result.

What I do I ping to the outside world (8.8.8.8) from a test VM in that subnet, For this moment all that the VMs have to do is see each other and the outside wolrd, and vice versa.

Really appreciate your help. New to fortigate, as you have proberly guessed.

Eric

tanr

New Member

1. If you've got an HP ProLiant DL360 G6 I would assume any nics that come with it can handle 802.1Q vlan tagging. A quick web search shows it as 8021.Q compliant. Note that the vlan interfaces from the FortiGate will only work with tagging, they don't do untagged vlans.

2. I don't think you want a (layer 2) vlan interface on your public facing wan port. Along with other problems, your upstream router will likely drop anything that isn't set to the default vlan 0. When you say you also have the same vlan set for your internal network, do you mean you've set it on a virtual-switch or switch-interface with that name? There are some big differences between FortiOS 5.0, 5.2, and 5.4 for this - see my comment on #3 below.

With the 60D and older versions of FortiOS you need to figure out how your internal switch mode is set. See http://kb.fortinet.com/kb/documentLink.do?externalID=FD37588 and https://blah.cloud/infrastructure/changing-fortigate-switch-mode-interface-mode/ for brief overviews.

Note that with FortiOS 5.4 the set type switch-vlan is rather different. See https://forum.fortinet.com/tm.aspx?m=139834 for a discussion.

3. FortiOS 5.0.11 (build 310) is pretty old, especially if it's a FortiGate 60D. Is there a reason you haven't upgraded it to 5.2.x or 5.4.x? I'm not familiar with 5.0.x.

4. I think you need to simplify this so that you can test each part separately on the FortiGate side before you pull in the VM side. On the FortiGate set a vlan 99 interface on an internal physical interface, NOT the wan interface and NOT any internal switch interface. Turn on admin access for ping on the vlan 99 interface (set allowaccess ping, or append allowaccess ping). Take a managed switch that can handle vlan tagging and connect it to the single physical port on the FortiGate which has the vlan 99 interface. Set that particular port on the switch to be vlan 99 tagged only. Set another port on the switch to be vlan 99 untagged. Hook a laptop to the vlan 99 untagged port, then see if you can ping the vlan 99 interface IP. Once you can do that, you can set up test security policies to allow wan access for vlan 99 and verify it works from the laptop. Then you can try adding in communication between vlans, with more vlans on the fortigate and the managed switch and another laptop.

Good luck!

Sign up

Login with SSO

Login to the community

Login with SSO