Internal routing

Question

100D's in HA:

The internal network is set for 10.4.1.x/24

We also have other internal networks from 10.1.1.x to 10.8.1.x that can all talk to our primary 10.4.1.x subnet

Our other networks are each on their own VLAN which is all handled by our core switch.

Currently, our Aruba 5406 does all the routing from the other subnets.

ip default-gateway 10.4.1.9 (FortiGate) ip route 0.0.0.0 0.0.0.0 10.4.1.9

In order for the firewall to be able to communicate to the other local subnet for AP discovery with FortiManager:

[ol]

Should we just change the subnet on the internal interface from /24 to /12 : 10.0.0.1 - 10.15.255.254

Or would it be better to create some kind of loopback interface?[/ol]

We just received two new 600E's that we'll be upgrading to soon as well.

TIA

Yurisk · Accepted Answer

If all you are trying to achieve is register APs to Fortigate over Layer 3 device, you can specify in APs config IP address of the Fortigate explicitly and it will register over the Aruba just as well:

Say Fortigate has IP of 10.4.1.254, on AP CLI set:

cfg -a AC_IPADDR_1=10.4.1.254

cfg -c

lobstercreed · Answer

I can't speak to the problem you're trying to solve (I use no FortiAP) but I can tell you that changing the subnet on the internal interface will absolutely not work. The FortiGate will suddenly think all the devices in that range are directly connected and stop routing to the Aruba 5406 to get to them - instead it will ARP fruitlessly.

Instead I would recommend bring those VLANs up to the firewall and letting the FortiGate do all the inter-VLAN routing. You'll gain visibility from the FortiGate and be able to put in better security controls. Make sure you use zones to make your life easier. :)

Sign up

Login with SSO

Login to the community

Login with SSO