Skip to main content
FortiKnight
FortiKnight
New Member
October 14, 2024
Solved

One VLAN, multiple subnets issue

  • October 14, 2024
  • 4 replies
  • 2843 views

Hello everyone,

 

I am running a Fortigate with FortiOS v7.4.5, where the default VLAN traffic arrives untagged on the LAN interface. Currently, several networks (e.g., 10.0.1.0/24 and 10.0.2.0/24) are operating over this interface.

After assigning a secondary IP address to the interface (10.0.1.3/24), routing between the two subnets works as expected. However, the security policies configured between these networks are not being enforced.

 

I have reviewed some relevant articles, but the suggested solutions do not seem to resolve the issue. According to these Fortinet Technical Tips, the traffic should be blocked by default and then allowed through the appropriate policies:

I have tested this in a lab environment, and as expected, the traffic between the subnets is routed, but the configured security policies are not being applied.

 

Is this behavior expected? Are there any alternatives, or is there something missing in the configuration?

Thank you in advance for your help.

Best answer by FortiKnight

TAC has found the solution to the problem:
Traffic handled by FortiGate for packet w... - Fortinet Community

 

Thank you everyone.

4 replies

AEK
SuperUser
AEK
SuperUser
October 14, 2024

Hi

Try with a software switch with explicit intra switch policy.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Software-switch-policy/ta-p/198381

Another method that "should" work is to put the interface in a zone with denied intra zone traffic, the create a policy to allow the required traffic.

AEK
zeucqu2
zeucqu2
New Member
October 14, 2024

Yes even if they are on the same VLAN ID, the systems don't know about anything outside of their configured subnet and will send all other traffic to the default gateway. The only difference is that they are all in the same broadcast domain. I won't rant about the ridiculousness of this because I'm sure you are already aware.

FortiKnight
FortiKnightAuthor
New Member
October 14, 2024

 

Thanks for your reply.

 

I configured the software switch in explicit mode, but routing between networks is blocked, and even after allowing traffic, the rules aren't applied. When using zones, traffic flows, but deny rules still don't work, just like before.

 

Is the only solution to move each network to a different interface or segment them into VLANs?

Also, what’s the purpose of those technical tips if they don’t seem to apply here? I'd like to understand that.

ebilcari
Staff
ebilcari
Staff
October 14, 2024

You can read more about firewall policies on same interface in this article. This is not recommended and can be used temporarily usually during a migration phase.

Using VLANs under the physicals interface (sub-interface) when a switch connects is the quickest way to isolate the hosts in L2 and easy apply in firewall policy as a dedicated interface:

sub-inter.PNG

Emirjon
FortiKnight
FortiKnightAuthor
New Member
October 15, 2024

Hello,

thank you for your reply. Unfortunately, this solution hasn’t resolved the issue either. When I try to modify rule 0, instead of updating it, a new rule is added with an ID different from 0, and the situation remains unchanged. The routing works correctly, but when I try to block traffic between one IP and another, or between different subnets, it doesn’t work. I’ve run several tests in the test environment, but the problem persists in every scenario.

FortiKnight
FortiKnightAuthorAnswer
New Member
October 29, 2024

TAC has found the solution to the problem:
Traffic handled by FortiGate for packet w... - Fortinet Community

 

Thank you everyone.

    Terms & ConditionsAccessibility statement