New Member

Solved

FortiGate use sub-vlan how to communicate with PC

Forum|Forum|7 years ago
December 20, 2018
7 replies
8896 views

Hello everyone

I have a question about fortigate use sub-vlan how to communicate with switch

I use EVE-LAB doing some test.

Here is my topo

and here are my switch G0/4 conf:

！

switchport trunk encapsulation dot1q switchport trunk native vlan 999 switchport mode trunk

！

PC1 ip address is 192.168.1.1/24

PC2 ip address is 192.168.2.1/24

PC1 should have been able to ping 192.168.1.254

PC2 should have been able to ping 192.168.2.254

But I use EVE-LAB, it is timeout .

Is it something wrong with my configuration?

There is another question, Is it need to configure switchport trunk native vlan 999 on switch?

Does the fortigate vlan 1 have a tag?

Any body have any thought?

Best Regards,

Tim

forti-inter.png

5.4

Best answer by Toshi_Esumi

If they're in FGT's arp table, you should be able to ping PCs from FGT. Have you tried? If this works, only other possibility is "trusthost" config in admin users is prohibiting from pinged. Include 192.168.1.0/24 and 2.0/24.

As I wrote first, untagged interface is the "port3" parent interface. You need to configure 1.254 on it without Vlan1 subinterface.

Toshi_Esumi

SuperUser

On fortigate "VLAN1" is tagged. On Cisco Vlan1 is default native-vlan for all ports and untagged. You need to configure 192.168.1.254/24 on port3 parent interface.

Is the second vlan 999 as in the switch config or 119 as in the image?

Toshi_Esumi

SuperUser

Sorry, I misread "native vlan" config. Then it's up to the port config for the PC1 and PC2. Did you configure those access ports vlan 1 and 119 respectively? And verify those VLANs are included on G0/4 with show int trunk.

Toshi_Esumi

SuperUser

Or, the new VLAN subinterfaces are not configured to allow pinging (set allowaccess ping) on the FGT.

Sign up

Login with SSO

Login to the community

Login with SSO