Skip to main content
DanST93
DanST93
Explorer
August 13, 2019
Solved

Help routing two networks

  • August 13, 2019
  • 2 replies
  • 3852 views

Hello there!

I am trying to add a new network to act as a dedicated iLO network.

I have configured an additional port on my Fortigate 60E router and have configured a policy route to route between this network and our Core network.

 

Core/Server Network: 192.168.69.0 /24

iLO Network: 192.168.50.0 /24

 

Our DHCP server lies on the 69 network and it is servicing IP Addresses to the iLO cards of our servers on the 50 network. I can ping the Router port and switch configured on the 50 network from the 69 network but cannot ping any of the iLO cards.

 

If I plug in a laptop to the 50 network switch I can ping the iLO cards and router and the 69 network port on the fortigate but cannot get any further. Also devices on the 69 network can ping the router port and switch on the 50 network but not the devices on it.

 

I'm wondering what I've missed here, and any help would be appreciated!

Thanks.

    Best answer by ede_pfau

    hi,

     

    and welcome to the forums.

    After re-reading your post I still wonder why you use a Policy Route. A PBR is a route which is matching fields other than the destination address, like source address, port etc.

    As far as I see it you only need a regular route. Actually, you don't need any extra route on the FGT - as long as your devices don't need internet access. Check 'Monitor > Routing Monitor' to see the active routes. You won't see any sign of your PBR which is one of the reasons I dislike PBRs. But, you'll see a route to the 69 subnet, and one to the 50 subnet. They are 'connected', and for subnets in which a FGT port participates, the FGT will insert a route automatically.

    When you've got the routing right, you need policies to allow traffic.

    You need 2 policies:

    - from 50 to 69

    - the reverse

    If you already have the first policy, right-click it and 'clone reverse' to create the second.

    For starters, use 'ALL' for service. No NAT.

     

    The problems you state do come IMHO from missing routes on your iLO cards. Their default route needs to point to the local FGT interface (say, .50.1). Otherwise, they don't know how to reach the 69 subnet. They don't route, the FGT does.

    Your switch seems to be configured correctly, though. Have a look at it's default route.

    And I wonder how your DHCP server shells out addresses from the 50 subnet while it doesn't have a direct connection (a port in) this subnet. But it seems you are seeing 50's IP leases on the switch and iLos.

    I'd just put a DHCP server on the 50 interface on the FGT, and DNS and NTP servers. Done.

     

    Let's see what you find.

    2 replies

    ede_pfau
    SuperUser
    ede_pfauAnswer
    SuperUser
    August 13, 2019

    hi,

     

    and welcome to the forums.

    After re-reading your post I still wonder why you use a Policy Route. A PBR is a route which is matching fields other than the destination address, like source address, port etc.

    As far as I see it you only need a regular route. Actually, you don't need any extra route on the FGT - as long as your devices don't need internet access. Check 'Monitor > Routing Monitor' to see the active routes. You won't see any sign of your PBR which is one of the reasons I dislike PBRs. But, you'll see a route to the 69 subnet, and one to the 50 subnet. They are 'connected', and for subnets in which a FGT port participates, the FGT will insert a route automatically.

    When you've got the routing right, you need policies to allow traffic.

    You need 2 policies:

    - from 50 to 69

    - the reverse

    If you already have the first policy, right-click it and 'clone reverse' to create the second.

    For starters, use 'ALL' for service. No NAT.

     

    The problems you state do come IMHO from missing routes on your iLO cards. Their default route needs to point to the local FGT interface (say, .50.1). Otherwise, they don't know how to reach the 69 subnet. They don't route, the FGT does.

    Your switch seems to be configured correctly, though. Have a look at it's default route.

    And I wonder how your DHCP server shells out addresses from the 50 subnet while it doesn't have a direct connection (a port in) this subnet. But it seems you are seeing 50's IP leases on the switch and iLos.

    I'd just put a DHCP server on the 50 interface on the FGT, and DNS and NTP servers. Done.

     

    Let's see what you find.

    DanST93
    DanST93Author
    Explorer
    August 13, 2019

    Ahhh! I had IPv4 Policies and Policy Routes! Turned off the policy routes, leaving the IPv4 Policies live and voila! It works!

    Thanks!

    wkana
    wkana
    New Member
    August 13, 2019

    I'm not a Fortigate expert by any means, but we are working through a similar scenario using a 100e.

     

    Have you setup any IPv4 policies to allow the traffic in both directions?

    Terms & ConditionsAccessibility statement