Skip to main content
gg9
gg9
Visitor III
March 16, 2025
Question

I cant get inter-vlan routing to work

I have a FortiGate 50E, unlisense, firmware v5.4.1

When try setup 2 vlan, 
vlan10 
ip 192.168.10.1/24

vlan20 

ip 192.168.20.1/24

if I enable DHCP on VLan then it wont give ip to any PC but DHCP on port still work
And no matter how much i try, i cant seam to get Vlan routing to work, i can still route vlan to the internet but vlan to vlan is impossible.

I try create vlan via GUI, CLI (dont think this make much different?),
config ipv4policy so it allow any type to any any destination, for both way, vlan10 to vlan 20 and vice versa
config static route to 192.168.10.0/24 interface vlan20 gateway 192.168.10.1 and to 192.168.20.0/24 interface vlan 10 gateway 192.168.20.1

I try run "show system route" cmd and all netwok is connect normally "c 192.168.10.1 255.255.255.0 is directy connect"-something like this, 
I cant get logging to work, I have enabe logging in policy, log security and log everything,
I try to ping client from fortinet CLI "exec ping 192.168.10(.20).1(.2)" it work, but not from one pc in one vlan to another pc in another vlan.
"tracert 192.168.10.1" on client pc (192.168.20.2) return "destination host unreachable" or "connect time out"

Any help is much appreciated. thanks guys

 

3 replies

yderek
Staff
yderek
Staff
March 18, 2025

Hi, gg9

 

1:Is there any layer 2 switch has involved in this setup ? If so, any vlan tagging ACL has done on downstream switch ? 

2: Get PC  mac address, while you trying to get PC obtain DHCP address, run the sniffer below first based on the PC NIC MAC address, see whether you FortiGate is receiving any packet from PC at all, CLI will be below, for example if you want 

To sniff the MAC Address when it is Source MAC = 00:09:0f:89 :10:ea    
# diagnose sniffer packet <interface> "(ether[6:4]=0x00090f89) and (ether[10:2]=0x10ea)"

3: You can ping between FortiGate VLAN interface this is expected however if your PC is not obtain the IP properly, you won't be able to reach each other hence resolve DHCP address first then go from there 

 

    gg9
    gg9Author
    Visitor III
    March 23, 2025

    Thanks for the reply,

    There is no layer two switch in my setup, just the built-in Lan port from the firewall
    The PC obtain IP address like normal if i enable dhcp server on physical or physical interface setting (PC set to dhcp not manual and ipconfig /all show dhcp server is indeed the interface ip) but when i try the sniff cmd it return:
    (pc plug into port lan1, i try remove the filter as well, the result are the same)

    interfaces=[lan1]
    filters=[(ether[6:4]=0x088FC352) and (ether[10:2]=0x005F)]
    pcap_lookupnet: lan1: no IPv4 address assigned






     

    gg9
    gg9Author
    Visitor III
    March 23, 2025

    I'll guess i try rip..

    it work, i dont know why i dont think of this earlier
    But it just 3 network so i really want to set static routing, some how it didnt work, so i guess rip or nothing, save me some headache.
    Why the automatic routing doesnt work (all network already show directly connected) but rip work tho...

    To enable rip go to: System -> Feature Select -> Advance Routing
    To config rip go to: Network -> RIP -> Tick Version 2 -> Network: enter ip/netmask -> add -> Interface: Create -> choose interface, send/recive version 2 and hit OK
    Hope this help someone!

    Terms & ConditionsAccessibility statement
    Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
    Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
    Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT