Ok hold on, this is going to be hard to believe and to describe. I have troubleshooted a lot and cannot find out where the problem lies. Suddenly I had this vague problems, of sites not loading, DNS not resolving, etc. Maybe related to upgrading to 7.0.10 or 7.0.11. Maybe not. What does not work (but had always worked like this - for years):I have a (existing) hardware switch "lan" with an SSID bridged to that (no VLANs).The IP address is on the lan switch and the SSID is bridged.Created a new test policy, top placed any/any allow, no filtering, NAT to internet.When I connect a mobile to this SSID and start roblox (don't ask - this is a prio 1 for days now) it does not load any game. What does work:I have created a (new) test vlan (99) with an IP address on it, and a test SSID bridged to that vlan (99), connected to the lan switch as my FortiAPs reside there.Created a new test policy, under the top placed any/any allow, no filtering, NAT to internet.When I connect a mobile to this SSID and start roblox it does load games.EDIT: Roblox is "the" way of proving/testing above. As described a lot more is not working smoothly, but a refresh of the page will do. Roblox seems to be a lot more "picky" in the coneection stability. Both "networks" are giving out the same DNS servers.I have 6 VLANS connected via the lan hardware switch which all work(ed) well for years. Of which 3 have an IP adress on the VLAN interface and 3 are connected in a software switch with a port.--> this can also be a separate topic because since this week I discovered the Fortigate does not allow me to select a VLAN anymore as a member of a softwareswitch (!), but this used to work and still works. Nothing to find in any release notes... I cannot find any mentioning of any change in behavior. Also I have no active subscription on this device (81E) and thus cannot call support. Is there anything I can do to (more) narrow down this issue?

New Member

Question

No reliable connection with hardware lan switch and bridged ssid

Forum|Forum|3 years ago
March 30, 2023
15 replies
16132 views

Ok hold on, this is going to be hard to believe and to describe. I have troubleshooted a lot and cannot find out where the problem lies. Suddenly I had this vague problems, of sites not loading, DNS not resolving, etc. Maybe related to upgrading to 7.0.10 or 7.0.11. Maybe not.

What does not work (but had always worked like this - for years):

I have a (existing) hardware switch "lan" with an SSID bridged to that (no VLANs).
The IP address is on the lan switch and the SSID is bridged.
Created a new test policy, top placed any/any allow, no filtering, NAT to internet.
When I connect a mobile to this SSID and start roblox (don't ask - this is a prio 1 for days now) it does not load any game.

What does work:

I have created a (new) test vlan (99) with an IP address on it, and a test SSID bridged to that vlan (99), connected to the lan switch as my FortiAPs reside there.
Created a new test policy, under the top placed any/any allow, no filtering, NAT to internet.
When I connect a mobile to this SSID and start roblox it does load games.

EDIT: Roblox is "the" way of proving/testing above. As described a lot more is not working smoothly, but a refresh of the page will do. Roblox seems to be a lot more "picky" in the coneection stability.

Both "networks" are giving out the same DNS servers.

I have 6 VLANS connected via the lan hardware switch which all work(ed) well for years. Of which 3 have an IP adress on the VLAN interface and 3 are connected in a software switch with a port.

--> this can also be a separate topic because since this week I discovered the Fortigate does not allow me to select a VLAN anymore as a member of a softwareswitch (!), but this used to work and still works. Nothing to find in any release notes...

I cannot find any mentioning of any change in behavior. Also I have no active subscription on this device (81E) and thus cannot call support.

Is there anything I can do to (more) narrow down this issue?

Show previous replies

sanderlAuthor

New Member

See this post where the IOT ssid (tunneled!) is also ~~bridged~~ connected to a port via a softwareswitch:

https://community.fortinet.com/t5/Support-Forum/Bridging-SSID-via-VLANs/m-p/209561

This is not possible via the GUI or CLI anymore (in 7.0.11), only a bridge ssid can be connected now - hence I am rebuilding my config to VLANs on the FG and the FAP and ditching the software switches.

gfleming

Staff

So I spun up a FortiGate in my lab running 7.0.10. Even 6.4 I tried for good measure. And I was unable to bridge a Tunnel-mode SSID into a software switch. So I have no idea how you had this working in 7.0.10......

Either way, it makes more sense to me that you just convert your SSIDs to bridge mode and then you can bridge them however you want.

sanderlAuthor

New Member

I had it running for years... Was the lab a physical device? 60E 81E?

And have you seen the screenshots on the other topic. Exactly that.

my problem is not thát, let's not focus on that. The problem is that a standard SSID which "drops" the traffic on the lan switch (softwareswitch) on the fortigate does not work ok anymore since 7.0.11. when reverting back to 7.0.10 and up to 7.0.10 it works like a charm. And Roblox is the app with which I can consistently check/troubleshoot this behavior.

--- Either way, it makes more sense to me that you just convert your SSIDs to bridge mode and then you can bridge them however you want.---

As described, that is what I have done between 7.0.10 an 7.0.11 but is NOT the topic of this forum topic :)

sanderlAuthor

New Member

So... today it was the big migration day. All converted to 1 HW Switch with VLANs and all SSIDs bridged. Makes the config more clear and consistent. It was a big hassle to get all VLAN config in the Netgears, whoever though of that interface must have been smoking something :-).

Quickly recap the situation before.

I came from a long road in terms of versions and config. All worked well for years when I was using software switches and by that means bridged tunneled (!) ssids to a softwareswitch combined with a hardware port. A dumb switch connected to such a switch would pass all traffic including tagged and untagged traffic.

This was up until 7.0.10 very successful. When I upgrade to 7.0.11 problems started. At first it was not very clear, random white pages, slow loading, games not starting, etc. The best way to test was by starting a Roblox game. This would always fail in 7.0.11. Downgrading to 7.0.10 and it always was successful.

Because I needed to do some and the "softwareswitch combination" was not accepted by the GUI and CLI anymore, I converted all networks to VLANs and created a new hardware switch (HW-Switch).

That's all in this novel topic.

Instantly when downgrading to 7.0.10 all problems were gone!

But now I have created the new setup I still have the same problems. Starting roblox on the SSID bridged to the LAN VLAN (10) is not able to start, Starting Roblox on the test99 SSID VLAN (99) is starts. Always, no exception.

Below the relevant configs. and attached the gui.

Config:

edit "HW-Switch"         set vdom "root"         set ip 192.168.253.1 255.255.255.0         set allowaccess ping https ssh http         set type hard-switch         set lldp-reception enable         set lldp-transmission enable         set role lan         set snmp-index 48     next edit "test99ssid"         set vdom "root"         set type vap-switch         set alias "b"         set role lan         set snmp-index 45     next     edit "HS-VLAN-LAN"         set vdom "root"         set ip 192.168.1.254 255.255.255.0         set allowaccess ping https ssh http         set device-identification enable         set monitor-bandwidth enable         set role lan         set snmp-index 49         set interface "HW-Switch"         set vlanid 10     next     edit "test99"         set vdom "root"         set ip 192.168.99.1 255.255.255.0         set allowaccess ping https ssh http         set role lan         set snmp-index 14         set interface "HW-Switch"         set vlanid 99     next   config system virtual-switch     edit "HW-Switch"         set physical-switch "sw0"         config port             edit "port7"             next             edit "port9"             next             edit "port10"             next             edit "port11"             next             edit "port12"             next         end     next end

sanderlAuthor

New Member

2nd try. Wrote a long story but seems it did not save on the forum.

today I had a busy day. Migrated all to 1 HW-Switch. All is "functional" now. But you don't believe it. The problem persists. Roblox does work in vlan99 (ssid test99) but not in vlan10... (LAN VLAN)

Quick recap:

I did not have any problems until 7.0.10. It started in 7.0.11. When downgrading to 7.0.10 problems were gone. I had to upgrade to 7.0.11 due to the usage of sslvpn.

I did us software switches combining hardware ports and tunneled ssids. Now all segments are VLANs on 1 hardware switch.

Some info from now:

The config:

edit "HW-Switch"         set vdom "root"         set ip 192.168.253.1 255.255.255.0         set allowaccess ping https ssh http         set type hard-switch         set lldp-reception enable         set lldp-transmission enable         set role lan         set snmp-index 48     next

edit "test99ssid"         set vdom "root"         set type vap-switch         set alias "b"         set role lan         set snmp-index 45     next     edit "HS-VLAN-LAN"         set vdom "root"         set ip 192.168.1.254 255.255.255.0         set allowaccess ping https ssh http         set device-identification enable         set monitor-bandwidth enable         set role lan         set snmp-index 49         set interface "HW-Switch"         set vlanid 10     next

edit "test99"         set vdom "root"         set ip 192.168.99.1 255.255.255.0         set allowaccess ping https ssh http         set role lan         set snmp-index 14         set interface "HW-Switch"         set vlanid 99     next

    edit "WiFi5G"         set vdom "root"         set type vap-switch         set alias "b"         set role lan         set snmp-index 19     next

config system virtual-switch     edit "HW-Switch"         set physical-switch "sw0"         config port             edit "port7"             next             edit "port9"             next             edit "port10"             next             edit "port11"             next             edit "port12"             next         end     next end

On the top of the policies there are 2 identical policies allowing vlan 99 and vlan 10 full to the internet...

Again: This problem was not there in 7.0.10 (!) Although now the situation is a little different.

gfleming

Staff

At this point you need someone to help you phsycially to actively be looking at the device and the network and doing a proper diagnosis. I think you've exhausted the usefulness of an internet forum at this point.

With that in mind, given everything works on 7.0.10 I would suggest perhaps you are encountering a bug in 7.0.11. It's the only explanation I have at this point.

So, why not stay on 7.0.10?

Also why not simplify your deployment and use bridged SSIDs?

sanderlAuthor

New Member

All SSIDs are bridged...

Stephan3tha

New Member

Verify hardware connectivity and ensure that the hardware LAN switch is properly connected to the network and the bridged SSID is properly configured. Check the cables, ports, and settings to ensure that everything is correctly set up. Check for network interference: Check for any network interference that could be affecting the connectivity between the hardware LAN switch and the bridged SSID. This could be caused by other devices or network equipment that are causing interference with the wireless signal.

sanderlAuthor

New Member

Hi Stephan3tha, thanks for the reply. Obviously all is checked over and over again. All seems fine.

Interference is not the issue... Same AP, different ssid and vlan.

All is connected exactly the same for ssids test99 and "normal" ssid...

See configs and layout above. test99 is a vlan (99) normal sidd is a vlan (10). Same policies (on top) and on same FortiAPs, both ssids bridged (one to vlan 99, one to vlan 10)

Both ssids are thus on the same AP, on the same radio...

shoot me...

sanderlAuthor

New Member

I am going to start a new topic due to recent changes and hard to understand starting point.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded