Skip to main content
vishal
vishal
Visitor III
June 19, 2019
Question

Fortigate to Palo Alto reachable

  • June 19, 2019
  • 2 replies
  • 7484 views
Hi team, I'm doing a testing lab in my environment as per attached scenerio Switch having an SVI of subnet 192.168.230.0/24, 10.2.2.0/24 Where my switch is connected on fortigate internal port1 IP (192.168.230.1) using ip 192.168.230.254. And fortigate is connected to Palo Alto using L3 link using internal port 3 IP (10.1.1.2) and same is configure on Palo Alto link connected to fortigate ip (10.1.1.1). Whereas fortigate and palto directly connected L3 link can ping each other. My problem is when I assigned vlan 20 of 10.2.2.0 subnet to my laptop I can reach fortigate L3 link ip 10.1.1.2 but can't reach palto Alto 10.1.1.1 Route on Palo alto To reach 10.2.2.0 next hop 10.1.1.2( fortigate L3 link) Policy Internal zone to internal zone policy is created Eg:- source 10.1.1.1/24 to destination 10.1.1.1/24 Route on fortigate To reach 10.2.2.0 next hop 192.168.230.254( switch directly connected link). Ipv4 policy Internal 1 (192.168.230.0/24) source 10.2.2.0/24 to internal 3 (10.1.1.2/24) destination any and same vice versa is created. Policy route Internal 1 (192.168.230.0/24) source 10.2.2.0/24 forwarding interface internal 3 (10.1.1.2) gateway 10.1.1.1( Palo Alto directly connected link ip) and same vice versa is created. Can anyone please help me what I'm missing here Any help will be appreciated. Regards, Vishal

    2 replies

    brycemd
    brycemd
    New Member
    June 19, 2019

    So is VLAN20 an interface on the fortigate? Or is routing through the switch? ie, what is the gateway for 10.2.2.0

     

    If it's on the fortigate your policy/rules need to define the VLAN as the interface rather than Internal1.

     

    If it's on the switch, does the switch have the proper routing setup?

     

     

    Also, policy routes shouldn't be needed in either case.

    vishal
    vishalAuthor
    Visitor III
    June 20, 2019
    Brycend, Vlan 20 is an SVI on switch. Yes vlan 20 is routing through the switch and reaching fortigate on internal port1 IP (192.168.230.1). Also on fortigate I have done reverse route for 10.2.2.0/24 via 192.168.230.254( switch management IP).
    hubertzw
    hubertzw
    New Member
    June 19, 2019

    You said you have a route on the FortiGate to vlan20 via 192.168.230.254.So if I good understand the path is:

    Laptop->SVI 10.2.2.0/23-> SVI 192.168.230.254->port1 (192.168.230.1)-FG-port3 (10.1.1.2)-> PAN 10.1.1.1

    You need a route on the switch: subnet 10.1.1.0/24 via 192.168.230.1

    and on the FortiGate you need the route: subnet 10.2.2.0/24 via 192.168.230.254 (I think you have this one) and firewall policy: port1 -> port3, from 10.2.2.0/24 to 10.1.1.0/24

    On PAN you need a route: subnet 10.2.2.0/24 via 10.1.1.2

     

    Can you upload the network diagram?

    vishal
    vishalAuthor
    Visitor III
    June 20, 2019
    Hubertwz, Thank for your reply. As per your suggestion I need a route on the switch: subnet 10.1.1.0/24 via 192.168.230.1, but already on my switch there's a default route towards 192.168.230.1. I think it should work if not please correct me. Also on fortigate ipv4 policy is port1 -> port3, from 10.2.2.0/24 to all (I think "all" should cover 10.1.1.0/24) where 10.1.1.0/24 subnet lies on Palo Alto inside zone. Please correct me if I'm wrong somewhere Regards, Vishal
    hubertzw
    hubertzw
    New Member
    June 20, 2019

    What about routing on PAN? It has to know where (gw 10.1.1.2) to send packets with destination 192.168.230.0/24 and 10.2.2.0/24.

     

    Can you ping from PAN to one of SVIs on the switch? For this you need a new policy port3->port1

    Terms & ConditionsAccessibility statement