Skip to main content
cbecker
cbecker
New Member
November 18, 2024
Question

Standalone FortiSwitch default route

  • November 18, 2024
  • 1 reply
  • 2144 views

A Standalone FortiSwitch configured with 3 VLANs and the interfaces to match.

Devices on the VLANs can ping each other but they cannot ping anything that must use the default route, stuff outside the 3rd party firewall.

 

If I add a static route to 8.8.8.8 I can ping it.

 

Any ideas why the default route isn't working?

 

config switch vlan
edit 1
set description "Data"
next
edit 2
set description "Door-Access"
next
edit 3
set description "IN-Printers"
next

 

edit "Doors"
set ip 192.168.2.254 255.255.255.0
set allowaccess ping https ssh
set snmp-index 60
set vlanid 52
set interface "internal"
next
edit "Printers"
set ip 192.168.3.254 255.255.255.0
set allowaccess ping https ssh
set snmp-index 61
set vlanid 54
set interface "internal"
next
edit "Data"
set ip 192.168.1.254 255.255.255.0
set allowaccess ping https ssh
set snmp-index 63
set vlanid 50
set interface "internal"
next

 

 

config router static
edit 1
set dst 0.0.0.0 0.0.0.0
set gateway 192.168.1.50
next

 

1 reply

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
November 19, 2024

Do you have an interface with 192.168.150.x/24 configured under "config system interface"?
Without it, it can't reach the gateway 192.168.150.50.
Or, if what I'm suspecting is correct, you actually don't have the default route in the routing table.
Try "get router info routing-table all". If the interface for the default gateway exists, it would show like below:

S224DFTFxxxxxxxx # get router info routing-t all
Codes: K - kernel route, C - connected, S - static, R - RIP,
            O - OSPF, I - IS-IS, T - Table, F - PBR,
            > - selected route, * - FIB route, q - queued, r - rejected, b - backup, ^ - HW install failed
            t  - trapped, o - offload failure

VRF default:
S>* 0.0.0.0/0 [10/0] via 10.x.x.1, mgmtXXX, weight 1, 00:00:05
<snip>

I'm suspecting it's not there in your FSW.


Toshi

cbecker
cbeckerAuthor
New Member
November 19, 2024

Toshi,

 

My mistake the gateway in the default route should have been 192.168.1.50 in the original post.

I have also verified that the route is in the routing-table.

get router info routing-table all
Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, T - Table,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup, ^ - HW install failed
t - trapped, o - offload failure

VRF default:
S>* 0.0.0.0/0 [10/0] via 192.168.1.50, Data, weight 1, 00:01:18
C>* 192.168.52.0/24 is directly connected, Door, 00:01:20
C>* 192.168.54.0/24 is directly connected, Printers, 00:01:20
C>* 192.168.1.0/24 is directly connected, Data, 00:01:20

 

The switch can ping 8.8.8.8 but not the clients connected to the switch.

 

execute ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=0 ttl=116 time=12.1 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=116 time=10.1 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=116 time=11.0 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=116 time=9.8 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=116 time=11.1 ms

--- 8.8.8.8 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 9.8/10.8/12.1 ms

 

The switch is running 7.2.8

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
November 20, 2024

I would assume all devices in VLAN 50 (192.168.1.0/24) can get through the gateway device (with IP:192.168.1.50) since the gateway is in the same subnet.
Then the next thing I would check is if the gateway device has routes for 192.168.2.0/24 and 192.168.3.0/24 to 192.168.1.254. Likely static routes.

Toshi

Terms & ConditionsAccessibility statement