Skip to main content
madsem
madsem
New Member
November 19, 2022
Question

FortiExtender lan extension monodirectional?

  • November 19, 2022
  • 1 reply
  • 3214 views

Hi all!

Provisioning a FortiExtender following docs and hints in KB, I'm unable to set up a bidirectional communication

Let me explain.

FGT40F has a LAN in 192.168.1.0/24 behind a 1Gb/s internet link.

I want to set up a FEX with a network 192.168.2.0/24 behind a 1Gb/s internet link.

Provisioning work very well, but from 192.168.1.0/24 I can ping anything in 192.168.2.0/24, but from 192.168.2.0/24 I cannot reach anything on 192.168.1.0/24.

Doing some debugging I see on FGT the correct static route to see 192.168.2.0/24, but on FEX I don't see it and I cannot find a working configuration.

I'm doing something wrong or I'm missing something?

Last try was with this doc: https://community.fortinet.com/t5/FortiExtender/Technical-Tip-How-to-setup-FortiExtender-LAN-Extension-with/ta-p/216578 and I can ssh into FEX from FGT without any problem, but any chance to reach 192.168.1.0/24 from 192.168.2.0/24 :(

This configuration is make me going crazy >_>

 

Any hint?

 

Thanks!

 

Sem

1 reply

gfleming
Staff
gfleming
Staff
November 19, 2022

What version of FOS are you running?

 

Do you have the policy allowing traffic from LAN Extension network?

 

https://docs.fortinet.com/document/fortigate/7.0.0/new-features/339612/introduce-lan-extension-mode-for-fortiextender-7-0-2

madsem
madsemAuthor
New Member
November 19, 2022

I'm on 7.2.3 on FGT and 7.2.2 on FEX.

Yes, I have that policy.

Thanks for your time!

 

Regards,

Sem

gfleming
Staff
gfleming
Staff
November 20, 2022

Full disclosure, I have never configured this before. But reading through the docs it appears as though the LAN behind the FEX shares the same subnet as the LAN Extension interface on the FGT. So if you have an existing LAN using 192.168.1.0/24 on the FGT, you'll probably need to create a new subnet 192.168.2.0/24 for the LAN Extension interface. Then, you can use this subnet on the FEX LAN as well and point clients to the FGT as the default gateway.

Terms & ConditionsAccessibility statement