Skip to main content
fortimaster
fortimaster
Explorer III
January 18, 2023
Solved

intra-switch-policy explicit or implicit?

  • January 18, 2023
  • 13 replies
  • 10048 views

Hello everyone. I have a Fortigate in which, with 2 physical interfaces, I have created a software switch.

In that switch  I have created some Vlans with IP. Traffic between those Vlans doesn't work without policies, which is what I'm looking for. Its ok.

 

However I have read about intra-switch-policy explicit and have verified that the policies that work are between the interfaces that make up the software switch. On the other hand, the IP, I give it to the switch software instead of the vlans. I have not been able to ping any Vlan within the software switch with the intra-switch-policy explicit command. It doesn't work even allowing , into permit all policys, the Vlans that I create and the physical interfaces of the switch software. I can Only ping traffic between the interfaces of the software switch, wich have the same IP.

 

So what I want is the first option, which works just the way I want it to. But I wonder if this way of configuring the switch software could give me security problems. And if I can't reach the IP of the Vlans of the switch software because I'm doing something wrong (despite having tried everything).

 

Is it possible to connect to the ip of the vlans of the switch software in an explicit mod or with this mode you can only make rules between the ports that make it up?
Thank you ¡¡¡

Best answer by gfleming

If you just want to control inter-VLAN routing then you are fine as-is.

 

If you want to control intra-VLAN (that is traffic within the same VLAN) you need to make some changes.

 

Let's just review fundamental networking concepts before we move on. You are suprised that VLAN 50 is passing through but you should not be. If the two switches were connected together directly (without FGT in the middle) and you were not doing any VLAN pruning on the trunk interface then the behaviour would be exactly the same: VLAN50 tagged packets would travel across the trunk no problem. There would be no filtering. The connections to the FortiGate is just a VLAN trunk—no pruning and no filtering on L2.

 

Once you create the VLAN interfaces on the FortiGate you are now able to control traffic at L3; that is, inter-VLAN traffic.

 

Is this what you want?

 

Also, one thing to note is that a software switch will push all network processing to the CPU and not use the NP ASIC. Depending on your FGT model this could case serious performance issues. Do you have the ability to create a hardware switch on your FGT model? Or do you have the abiltiy to change your topology? Can the second switch be daisy-chained off the first switch?

13 replies

Anthony_E
Staff
Anthony_E
Staff
January 22, 2023

Hello,

 

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Regards,

Best Regards
Anthony_E
Staff
Anthony_E
Staff
January 24, 2023

Hello,

 

We are still looking for someone to help you.

We will come back to you ASAP.


Regards,

Best Regards
akristof
Staff
akristof
Staff
January 24, 2023

Hello.

If you are trying to reach from VLAN2 > SoftwareSwitch via ping (VLAN2 is bounded to SoftwareSwitch), you will still need firewall policy from Vlan2 to softwareSwitch. Maybe I don't understand entirely what is not working. I would recommend to share packet capture for the ICMP ping that is failing and you can also do debug flow. Then we will have better idea what is exactly not working and which traffic flow does not work.

Explicit intra-switch-policy does not have direct effect on if some traffic will work or not (except the fact that you need to have valid policies).

    gfleming
    Staff
    gfleming
    Staff
    January 24, 2023

    It's not very clear what you are attempting or trying to do here.

     

    It sounds like your issue is you cannot ping/connect to the VLAN interface IP?

     

    Have you allowed ICMP access on the VLAN interface?

      fortimaster
      fortimasterAuthor
      Explorer III
      January 24, 2023

      I must apologize, I don't speak English well and it's hard for me to explain myself.

       

      What really amazes me about the switch software is the way it works. I have done a lab and I have verified that if you connect a device to a port that sends 802.1q traffic in VLAN 50 and another port on the same software switch that sends 802.1q tagged traffic in Vlan 50 they can communicate with each other without creating the VLAN in the switch software (no gateway needed). The software switch does not look at the tag and the traffic passes even if you have several vlans created in the switch software.

       

      However, if we want to route the VLANS with others from the switch software, or other firewall ports, it does distinguish the VLANs. When you are routing traffic distinguishes the tagg.


      That's why I was wondering if explicit mode might be more recommended, but I've read that in that mode you can only make rules for traffic coming through the software switch ports, between them. But not with other Firewall ports. Therefore, this option is not valid for me and I will have to understand how the switch software works in level 2 since it seems that if there is no routing, it communicates everything that happens between its ports regardless of anything. Similar to a HUB?

       

      I really appreciate your help and I will continue investigating to see if I can understand and get used to the fact that the traffic that goes through it, at level 2, seems to not take the label into account and see if this could pose a security problem between the Vlans created in the switch software, to route between them with policies through the firewall, which will be the gateway for each of them.

       

      Thanks ¡¡

      gfleming
      Staff
      gfleming
      Staff
      January 24, 2023

      You are describing the basic functionality of a switch. Packets with the same 802.1q VLAN tags will be forwarded between ports that exist in VLAN50. If your software switch has VLAN50 configured then yes of course the FortiGate will just forward those packets between interfaces.

       

      The only thing intra-switch-policy explicit does it prevent that default switch behaviour and reuqires you to have FW policies defined even for devices in the same VLAN.

       

      When intra-switch-policy explicit is enabled you will not be able to ping the L3 interface on the FW (it acts like a transparent mode FW—all layer 2, no layer 3).

       

      https://community.fortinet.com/t5/FortiGate/Technical-Tip-Software-switch-policy/ta-p/198381

        Terms & ConditionsAccessibility statement