Skip to main content
tbar1704
tbar1704
Explorer
October 9, 2023
Solved

Moving Virtual Interfaces from Layer 3 switch to Fortigate - Adding Virtual Interfaces to Fortigate

  • October 9, 2023
  • 6 replies
  • 6276 views

Currently our Fortigate is connected to an Access Port on our Core Switch tagged with VLAN 4000. The Core Switch has all our Virtual Interferfaces configured on it with no restrictions on what VLANs can see/access other VLANs.

 

The core switch has a static route "ip route-static 0.0.0.0 0.0.0.0 10.255.254.254" where 10.255.254.254 is the IP Address of the Fortgate port (Port 4) connected to the Access Port on the Core Switch

 

The ultimate goal is to move all Virtual Interfaces to the Fortigate se we can start doing segementation.

 

For now I just want to add a new VLAN/VLAN Interface to the Fortigate so I can segment that.

     - I created the new VLAN / VLAN Interface under Port 4 on the Fortigate (VLAN 210) 

     - I created a new trunk port on the Core Switch that looks like this

          interface GigabitEthernet4/0/24
            port link-mode bridge
            description Trunk to Firewall LAN
            port link-type trunk
            port trunk permit vlan 210 4000

 

When I move the LAN connection from Port 4 on the Fortigate from the Access Port on the Core Switch to the new trunk port on the Core Switch the LAN loses all connectivity to the Fortigate. I'm assuming it has something to do with the trunk port I created but I don't know what I'm missing

 

Thank you

Best answer by Toshi_Esumi

The VLAN 4000 is NOT a tagged interface on the fortigate port4 because the switch port is "access". The switch was stripping the tag for VLAN 4000 traffic before sending to the FGT.

With the new trunk port, the VLAN 4000 is now tagged, which the FGT port4 doesn't have the VLAN interface configured.

 

Two options.

Option1: This is what @spoojary is assuming. If the switch supports native VLAN per port, you can set the new trunk port's native VLAN to 4000.

Option2: Rip the L3 config from port4 and create a new VLAN 4000 subinterface on the FGT then put it on the port4. To do this you likely need to remove all policies and other config referring port4, then recreating them with the new VLAN 4000's name.

Toshi

6 replies

spoojary
Staff
spoojary
Staff
October 9, 2023

f you set VLAN 4000 as the native VLAN on the trunk port, make sure the corresponding interface on the FortiGate also treats VLAN 4000 traffic as untagged/native. Configure VLAN 210 as a tagged VLAN on the FortiGate.

    Toshi_Esumi
    SuperUser
    Toshi_EsumiAnswer
    SuperUser
    October 9, 2023

    The VLAN 4000 is NOT a tagged interface on the fortigate port4 because the switch port is "access". The switch was stripping the tag for VLAN 4000 traffic before sending to the FGT.

    With the new trunk port, the VLAN 4000 is now tagged, which the FGT port4 doesn't have the VLAN interface configured.

     

    Two options.

    Option1: This is what @spoojary is assuming. If the switch supports native VLAN per port, you can set the new trunk port's native VLAN to 4000.

    Option2: Rip the L3 config from port4 and create a new VLAN 4000 subinterface on the FGT then put it on the port4. To do this you likely need to remove all policies and other config referring port4, then recreating them with the new VLAN 4000's name.

    Toshi

      tbar1704
      tbar1704Author
      Explorer
      October 10, 2023

       ?

      tbar1704
      tbar1704Author
      Explorer
      October 10, 2023

      Thank you both for the responses. Setting the Native VLAN made sense.

       

      I add the VLAN 4000 as the Native VLAN on my new trunk port (PVID 4000) and when I moved the connection over I lost Internet access.

       

      I have a small percentage of my Address Object assigned to the Interface LAN (port 4). A colleague suggested those interfaces need to be removed?

       

      thoughts?

      Toshi_Esumi
      SuperUser
      Toshi_Esumi
      SuperUser
      October 10, 2023

      That shouldn't cause this type of problem. You just can't mix objects assigned to specific different interfaces, or "any", together in one policy.
      Sniff traffic at the FGT Port4 when you send packets from VLAN 4000. I'm guessing it's still tagged with 4000, and you would see it (content is hid) in the sniffing.

       

      Toshi

        Toshi_Esumi
        SuperUser
        Toshi_Esumi
        SuperUser
        October 10, 2023

        If you sniff the parent interface without filter, VLAN tagged traffic would show up like below (VLAN 201):
        fgxxx-utm (root) # diag sniffer packet wan
        interfaces=[wan]
        filters=[none]
        pcap_lookupnet: wan: no IPv4 address assigned
        1.200000 802.1Q vlan#201 P0
        1.201753 802.1Q vlan#201 P6
        1.429195 802.1Q vlan#201 P0
        1.429272 802.1Q vlan#201 P0
        1.508286 802.1Q vlan#201 P0
        1.508327 802.1Q vlan#201 P0
        ^C

          tbar1704
          tbar1704Author
          Explorer
          October 11, 2023

          The parent interface is port4 and its alias is LAN. When I try to run the comand in the CLI I get this:

           

          fgxxx-utm # diag sniffer packet lan
          interfaces=[lan]
          filters=[none]
          pcap_activate: No such device exists for lan

           

          I'm assuming I should run the command using port4 as the interface?

          Toshi_Esumi
          SuperUser
          Toshi_Esumi
          SuperUser
          October 11, 2023

          What interface has 10.255.254.254? Can you share the part of config under "config sys int"? Does your FGT have "lan" hard-switch or soft-switch interface including port4?

           

          Toshi

            Terms & ConditionsCookie settingsAccessibility statement