Skip to main content
A
Anonymous_User
Contributor
August 24, 2010
Question

Software switch with VLAN sub interfaces = no go !?

  • August 24, 2010
  • 20 replies
  • 9322 views
Evening all, have logged this with Fortinet support but thought i would try the neighborly approach as well ;) Setup: - Two ports configured as a software switch, this switch has no IP assigned and no management access of any kind. - A VLAN subinterface was created on the software switch, this was assigned an IP and management access as well as ping. - An ESX test server connected to each switch port (trunk) with suitably tagged test VM in place. - Firewall NAT policy in place to allow hosts on the VLAN out to the internet. Issue: The two VM test servers are able to talk to each other across the firewall' s two switch ports via the VLAN subinterface. No problem here, they can ping the gateway address also no prob. They can also ping out to the internet as expected. The issue is the hosts are NOT able to actually load a web page from the itnernet, or even the local network (outside of the VLAN), browsers just sit there waiting for the return data after DNS lookups are done. This is strange becuase: - The same test VM servers can access the internet perfectly when the subinterface is on one physical port and not a soft switch. - The same test VM servers can access the internet perfectly when connected to a soft switch directly (no VLAN subinterface) - All of the expected routes are shown in the route monitor and pings to the internet work flawlessly as do DNS lookups. - I can telnet from a test server to a web server on port 80 no problem. So there seems to be either some configuration step I have missed that is required for using VLAN subinterfaces AND soft switches together ... or a bug ? or something else ... ?

    20 replies

    Carl_Wallmark
    Carl_Wallmark
    New Member
    August 24, 2010
    Hi, what firmware are you using ? i had these problems with early 4.0 MR1, and also with 4.0,
    A
    Anonymous_UserAuthor
    Contributor
    August 24, 2010
    Am running the latest 4.0 MR2 Patch 1 (build 0279,100519), forgot to mention its on a Fortigate 200B. Given you ' had' these problems, was it fixed in a subsequent release and identified as a bug ?
    Carl_Wallmark
    Carl_Wallmark
    New Member
    August 24, 2010
    yes, they were all fixed with a patch, are your sure you have all the firewall policys you need ?
    A
    Anonymous_UserAuthor
    Contributor
    August 24, 2010
    Pretty sure, essentially the rules were the same as for the straight software switch and VLAN sub (without soft switch) ... interestingly ping to the internet works flawlessly as does telnet to a web server on port 80. Source Int: VLAN 73 (this is the vlan subinterface on the soft switch) Source Address: Subnet 73 (private address range servers sit on) Destination Int: port1 (internet connected port, default route is in place) Destination Address: all Schedule: always Service: ANY Action: ACCEPT NAT: Enable NAT
    Carl_Wallmark
    Carl_Wallmark
    New Member
    August 24, 2010
    it sounds like one of the bugs i had, test this: lower the MTU value on the VLAN interface, if thats not working, wait until tomorrow, appearantly patch 2 for MR2 will be out...
    A
    Anonymous_UserAuthor
    Contributor
    August 24, 2010
    Well this is all getting a bit interesting, you were right on the money Selective !! I lowered the MTU on the test servers and all is now working as it should be, however there is no option to change MTU (that i can see) for either the software switch or the VLAN subinterface. Maybe these need to be set on the ports before the soft switch is created ? I discovered that if the ports are administratively down before making the soft switch, they remain down after and there is no way to bring them up !! Maybe its the same.
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    August 25, 2010
    in the Web GUI, System / Network / your_interface, just above the admin access settings: " Override MTU value" , tick and set it. As I don' t have enough unused ports on my FG I can' t test it on a softswitch port, though. If the option is missing then I' d bet you' d have to set it on both physical ports beforehand.
    Citylight
    Citylight
    New Member
    August 25, 2010
    Hi Ede, yes it is that way. There is no option at the GUI but the CLI lets you change the MTU without any warnings. But it won' t work. It is important to change the MTU before building the soft switch. Citylight
    Carl_Wallmark
    Carl_Wallmark
    New Member
    August 25, 2010
    nice to hear it worked, but it must be a bug ! can you test to change MTU before making a soft-switch ?
    A
    Anonymous_UserAuthor
    Contributor
    August 25, 2010
    Morning all ... Fortinet support say that you should do the following: - Set mtu-override enable on the soft switch via CLI - Set mtu value on the soft switch via CLI - Set mtu-override on the VLAN sub interface Have tried this just now (with a reboot) with no luck so have reported this back to them. I' m going to rebuild the switch once more and set the MTU values on the physical ports, there must be some combination that works !!
    A
    Anonymous_UserAuthor
    Contributor
    August 26, 2010
    Still no joy getting this to work, have rebuilt the switch with the physical port MTU' s set beforehand and still nothing, then went and changed the mtu-override and set value for the soft switch as well as mtu-override for the VLAN and yet still no http traffic. No response from Fortinet over night also ... its starting to feel pretty lonely :p
    Show more replies
    Terms & ConditionsAccessibility statement