New Member

Solved

One VLAN, multiple subnets issue

7 replies
2966 views

Hello everyone,

I am running a Fortigate with FortiOS v7.4.5, where the default VLAN traffic arrives untagged on the LAN interface. Currently, several networks (e.g., 10.0.1.0/24 and 10.0.2.0/24) are operating over this interface.

After assigning a secondary IP address to the interface (10.0.1.3/24), routing between the two subnets works as expected. However, the security policies configured between these networks are not being enforced.

I have reviewed some relevant articles, but the suggested solutions do not seem to resolve the issue. According to these Fortinet Technical Tips, the traffic should be blocked by default and then allowed through the appropriate policies:

I have tested this in a lab environment, and as expected, the traffic between the subnets is routed, but the configured security policies are not being applied.

Is this behavior expected? Are there any alternatives, or is there something missing in the configuration?

Thank you in advance for your help.

FortiGate

FortiKnightAnswer

New Member

TAC has found the solution to the problem:
Traffic handled by FortiGate for packet w... - Fortinet Community

Thank you everyone.

AEK

SuperUser

Hi

Try with a software switch with explicit intra switch policy.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Software-switch-policy/ta-p/198381

Another method that "should" work is to put the interface in a zone with denied intra zone traffic, the create a policy to allow the required traffic.

AEK

zeucqu2

New Member

Yes even if they are on the same VLAN ID, the systems don't know about anything outside of their configured subnet and will send all other traffic to the default gateway. The only difference is that they are all in the same broadcast domain. I won't rant about the ridiculousness of this because I'm sure you are already aware.

FortiKnightAuthor

New Member

Thanks for your reply.

I configured the software switch in explicit mode, but routing between networks is blocked, and even after allowing traffic, the rules aren't applied. When using zones, traffic flows, but deny rules still don't work, just like before.

Is the only solution to move each network to a different interface or segment them into VLANs?

Also, what’s the purpose of those technical tips if they don’t seem to apply here? I'd like to understand that.

ebilcari

Staff

You can read more about firewall policies on same interface in this article. This is not recommended and can be used temporarily usually during a migration phase.

Using VLANs under the physicals interface (sub-interface) when a switch connects is the quickest way to isolate the hosts in L2 and easy apply in firewall policy as a dedicated interface:

Emirjon

FortiKnightAuthor

New Member

Hello,

thank you for your reply. Unfortunately, this solution hasn’t resolved the issue either. When I try to modify rule 0, instead of updating it, a new rule is added with an ID different from 0, and the situation remains unchanged. The routing works correctly, but when I try to block traffic between one IP and another, or between different subnets, it doesn’t work. I’ve run several tests in the test environment, but the problem persists in every scenario.

FortiKnightAuthorAnswer

New Member

TAC has found the solution to the problem:
Traffic handled by FortiGate for packet w... - Fortinet Community

Thank you everyone.

Sign up

Login with SSO

Login to the community

Login with SSO