Skip to main content
Lmelim
Lmelim
New Member
January 16, 2022
Solved

Fortigate DMZ accesing from LAN

  • January 16, 2022
  • 2 replies
  • 5946 views

Hello

Can i configure FORTIGATE in order that internal LAN interface on PORT1 (VLAN30) of the FORTIGATE can comunicate to the builtin DMZ interface (no VLAN)?
I setuped IP 172.16.30.1 on LAN (port1) and 20.20.20.1 on DMZ Interface but im not abble to ping from LAN to DMZ (i have INTERNET on both interfaces)....what could be the reason?

thanks

Best answer by ede_pfau

The point here is that the VLAN30 interface is a sub-interface of the LAN port. But, the policy needs to allow traffic from "VLAN30" to "DMZ" interfaces, not from "LAN" interface.

Then, allow PING on the DMZ interface (in the interface setup).

 

BTW, take great care that there is no policy from DMZ to VLAN30 if the DMZ is a real DMZ. This would be a 'best practice'.

2 replies

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
January 16, 2022

You need to have a policy, or a set of policies, between VLAN30 and DMZ.

ede_pfau
SuperUser
ede_pfauAnswer
SuperUser
January 16, 2022

The point here is that the VLAN30 interface is a sub-interface of the LAN port. But, the policy needs to allow traffic from "VLAN30" to "DMZ" interfaces, not from "LAN" interface.

Then, allow PING on the DMZ interface (in the interface setup).

 

BTW, take great care that there is no policy from DMZ to VLAN30 if the DMZ is a real DMZ. This would be a 'best practice'.

Lmelim
LmelimAuthor
New Member
January 16, 2022

Great
Thank you very much for your help

Terms & ConditionsAccessibility statement