Skip to main content
jadeltoro
jadeltoro
New Member
November 21, 2023
Solved

Routing internal interfaces between 2 subnets

  • November 21, 2023
  • 6 replies
  • 7647 views
Hello good morning. Please, I wanted to ask the following question. I have a router connected to port 5 on my Fortigate in the following IP range: 192.168.30.100/24. On the other hand, I have on port 3 (configured as an interface) an output to a switch in the range 192.168.1.0/24. I am trying to communicate each subnet with the other by establishing a firewall policy that has port 3 as output and port 5 as input, but I cannot access it. What am I doing wrong? Thank you.
Best answer by jadeltoro

Hi,
I'm sorry for the delay and inconvenience caused.
In the end, everything was configured correctly, the only thing left to do was configure the 192.168.30.100 gateway on the side of ports 3 and 5.
Thank you all for your collaboration. A cordial greeting.

6 replies

srajeswaran
Staff
srajeswaran
Staff
November 21, 2023

1. Can both subnet device atleast ping the Fortigate interface IPs?
2. Check the ARP table on Fortigate "get system arp" and see if the destination IPs are learned

If the above 2 are working, we need to re-evaluate the policy config else there is something else outside Firewall config.

    jadeltoro
    jadeltoroAuthor
    New Member
    November 21, 2023

    Hello, thank you for your quick response.
    I cannot ping, neither from the 192.168.1.0 network to the computers on the 192.168.30.100 network, nor the other way around.
    In the ARP table, it only shows the gateway IP address of the router connected to port5: 192.168.30.101 0 "mac" port5.
    There are more devices connected, at other addresses on the same subnet: 192.168.30.x, but they do not appear in the ARP table.

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    November 21, 2023

    @srajeswaranis asking you to ping from the FGT in CLI to the connected device, then check the ARP table. If you still don't see the device you pinged in the table, there is a L2 connection problem over the switch(es).

     

    Toshi

      thoufik786
      thoufik786
      Explorer
      November 21, 2023

      Hi @jadeltoro,

       

      Please share the output of the below commands from FGT.

       

      execute ping-options source 192.168.30.100  

      execute ping 192.168.1.160

      execute ping 192.168.30.101

       

      execute ping-options source 192.168.1.160   

      execute ping 192.168.30.100

      execute ping 192.168.1.2

       

      Regards,

      Thoufik.

        jadeltoro
        jadeltoroAuthor
        New Member
        November 21, 2023

        FortigateWAN # execute ping-options source 192.168.30.100

        FortigateWAN # execute ping 192.168.1.160
        PING 192.168.1.160 (192.168.1.160): 56 data bytes
        64 bytes from 192.168.1.160: icmp_seq=0 ttl=255 time=0.2 ms
        64 bytes from 192.168.1.160: icmp_seq=1 ttl=255 time=0.1 ms
        64 bytes from 192.168.1.160: icmp_seq=2 ttl=255 time=0.2 ms
        64 bytes from 192.168.1.160: icmp_seq=3 ttl=255 time=0.1 ms
        64 bytes from 192.168.1.160: icmp_seq=4 ttl=255 time=0.2 ms

        --- 192.168.1.160 ping statistics ---
        5 packets transmitted, 5 packets received, 0% packet loss
        round-trip min/avg/max = 0.1/0.1/0.2 ms

        FortigateWAN # execute ping 192.168.30.101
        PING 192.168.30.101 (192.168.30.101): 56 data bytes
        64 bytes from 192.168.30.101: icmp_seq=0 ttl=64 time=0.5 ms
        64 bytes from 192.168.30.101: icmp_seq=1 ttl=64 time=0.4 ms
        64 bytes from 192.168.30.101: icmp_seq=2 ttl=64 time=0.3 ms
        64 bytes from 192.168.30.101: icmp_seq=3 ttl=64 time=0.3 ms
        64 bytes from 192.168.30.101: icmp_seq=4 ttl=64 time=0.3 ms

        --- 192.168.30.101 ping statistics ---
        5 packets transmitted, 5 packets received, 0% packet loss
        round-trip min/avg/max = 0.3/0.3/0.5 ms

        FortigateWAN # execute ping-options source 192.168.1.160

        FortigateWAN # execute ping 192.168.30.100
        PING 192.168.30.100 (192.168.30.100): 56 data bytes
        64 bytes from 192.168.30.100: icmp_seq=0 ttl=255 time=0.1 ms
        64 bytes from 192.168.30.100: icmp_seq=1 ttl=255 time=0.1 ms
        64 bytes from 192.168.30.100: icmp_seq=2 ttl=255 time=0.1 ms
        64 bytes from 192.168.30.100: icmp_seq=3 ttl=255 time=0.1 ms
        64 bytes from 192.168.30.100: icmp_seq=4 ttl=255 time=0.1 ms

        --- 192.168.30.100 ping statistics ---
        5 packets transmitted, 5 packets received, 0% packet loss
        round-trip min/avg/max = 0.1/0.1/0.1 ms

        FortigateWAN # execute ping 192.168.1.5
        PING 192.168.1.5 (192.168.1.5): 56 data bytes
        64 bytes from 192.168.1.5: icmp_seq=0 ttl=128 time=0.5 ms
        64 bytes from 192.168.1.5: icmp_seq=1 ttl=128 time=0.5 ms
        64 bytes from 192.168.1.5: icmp_seq=2 ttl=128 time=0.4 ms
        64 bytes from 192.168.1.5: icmp_seq=3 ttl=128 time=0.5 ms
        64 bytes from 192.168.1.5: icmp_seq=4 ttl=128 time=0.6 ms

        --- 192.168.1.5 ping statistics ---
        5 packets transmitted, 5 packets received, 0% packet loss
        round-trip min/avg/max = 0.4/0.5/0.6 ms

         

        The IP 192.168.1.5 was the first IP assigned to a computer.

        Thanks in advance.

        smaruvala
        Staff
        smaruvala
        Staff
        November 21, 2023

        Hi, 

         

        - From the above ping tests it looks the communication from the firewall egress IP to the destination is good. 

        - When you are trying to ping from the source to the destination do you see the logs in the traffic logs of the Firewall?
        - Have you tried to check the sniffer/packet capture on the firewall when performing the testing?
        https://community.fortinet.com/t5/FortiGate/Technical-Tip-Packet-capture-sniffer/ta-p/198313

        - In the security policy which is allowing the communication is the source NAT enabled? If not you can try to enable the same so that the traffic gets translated to egress interface IP. This will help if the destination is not having the correct route back to the source Subnet.

         

        Regards,

        Shiva

          Toshi_Esumi
          SuperUser
          Toshi_Esumi
          SuperUser
          November 21, 2023

          Is the router allowing mulitple IPs from the same 192.168.30.0/24 subnet on multiple ports? It's odd. I'm almost sure you can't ping 192.168.30.102, .301, and .302 from the FGT.
          I would suggest you setup a separate /30 subnet like 192.168.31.0/30 then set .1 on the router port and .2 on the FGT port5, also move the DVR from the router port to the switch, which is more natural.

           

          Toshi

            jadeltoro
            jadeltoroAuthor
            New Member
            November 22, 2023

            Hi,

            1) Is the router allowing mulitple IPs from the same 192.168.30.0/24 subnet on multiple ports? YES

            2) It's odd. I'm almost sure you can't ping 192.168.30.102, .301, and .302 from the FGT.

            I don't understand you well, from the commands that you indicated previously and that I showed the output, FGT can ping the IPs of the subnet 192.168.30.100, 192.168.30.101,
            192.168.30.102...

            3) I also don't quite understand why make a new subnet 192.168.31.x/24 and move the recorder to the switch.
            The cameras have their own PPPoE protocol connected to their own switch and I want to have separate security connected to an independent port on FGT.
            Thank you.

            Toshi_Esumi
            SuperUser
            Toshi_Esumi
            SuperUser
            November 22, 2023

            Ok, so there are more network components to the diagram you posted before. A regular routers like FGTs don't allow IPs from the same subnet to different port/interface used for routing unless those are bound to one routing interface, which likely your routers case. Likely those ports are switchports line a "LAN" (port 1 - 8 ) while "WAN" port exists.

            Toshi

              jadeltoro
              jadeltoroAuthor
              New Member
              November 22, 2023

               

              -

               

              Nchandan
              Staff
              Nchandan
              Staff
              November 22, 2023

              Hi team,

              You can check that FortiGate has the necessary routes to reach both subnets. You may need static routes or a dynamic routing protocol configured to ensure proper routing between the subnets.

               

              And also the firewall policy for internal to external that's is port3 to port5 should be configured for example

              config firewall policy

              edit 1

              set srcintf "port3"

              set dstintf "port5"

              set srcaddr "all"

              set dstaddr "all"

              set action accept

              next

              in  this manner.

                jadeltoro
                jadeltoroAuthorAnswer
                New Member
                November 22, 2023

                Hi,
                I'm sorry for the delay and inconvenience caused.
                In the end, everything was configured correctly, the only thing left to do was configure the 192.168.30.100 gateway on the side of ports 3 and 5.
                Thank you all for your collaboration. A cordial greeting.

                Terms & ConditionsAccessibility statement