Visitor III

Solved

Trying to create a Sub-Interface on Vlan 1 without much luck

Forum|Forum|1 year ago
January 28, 2025
12 replies
4517 views

I have a situation where I have 4 unique subnets.

192.168.0.0/24

192.168.1.0/24

192.168.2.0/24

192.168.3.0/24

Currently, there are no Vlans defined on the switch, so they are all in VLAN 1. A Cisco router is currently serving as a Gateway for this site and has the following

interface GigabitEthernet0/0/0

ip address 192.168.0.1 255.255.255.0

ip address 192.168.1.1 255.255.255.0 secondary

ip address 192.168.2.1 255.255.255.0 secondary

ip address 192.168.3.1 255.255.255.0 secondary

I would like to slip in a Fortigate Firewall to serve as the gateway device, but i need a way to service all of the subnets that are all residing in Vlan1 over a single ethernet cable. I have tried to give the port a parent IP address, similar to Cisco, with secondary ip addresses...but i cant ping from the network to the respective secondary ip address and vice-versa. The parent ip address works fine. any ideas? I have tried configuring the Cisco port as a trunk and access port with no change either way. i would think my las option would be to have a dedicated port for each subnet, but i would rather keep it to one.

any help is greatly appreciated,

Steve K. in Austin TX

Best answer by Toshi_Esumi

You said you added another "interface" on VLAN1 on the Cisco SW. Is it the secondary IP? If Cisco SW is working as L2 switch, unless the FGT port1 config has the same subnet configured as its secondary IP, the FGT can't accepts packet from the switch side because the source IP is not in side of port1's untagged interface subnet.

And, as I said before, FGTs don't accept vlan-id 1 when you try configuring the VLAN subinterface. It might accept the config but just doesn't work.

You just need to match the config between the Cisco switch and the FGT. If untagged, it has to be in the port1 config (means secondary IPs if multiple). If VLANs, the same matching VLAN subinterfaces need to be configured on the port1.
This is the same when you have another Cisco switch and connnects it to the current Cisco switch over a trunk port.

Toshi

Toshi_Esumi

SuperUser

Follow this KB to configure multiple secondary IPs. I don't know how many you can configure, but with my test, I could at least configure 3 secondary IPs, which you need.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Set-a-secondary-IP-on-a-FortiGate-interface/ta-p/226046

Toshi

funkylicious

SuperUser

what @Toshi_Esumi gave you should do the trick.

as per how many can be configured, according to https://docs.fortinet.com/max-value-table ,system.interface:secondaryip 256

you just need to leave the switch interface in access mode vlan 1 and configure all the IPs on the FGT interface connected to that port, make sure to enable administrative access ping on all in order for them to reply to ICMP.

L.E. you might need to create firewall rules from portX subnetA to portX subnet B in order to allow traffic, dont recall if they can 'talk' to each other implicitly/by default.

"jack of all trades, master of none"

KemoAuthor

Visitor III

thanks for the quick reply! in my case, i was able to create the sub-interfaces without issue using the same procedure you recommend. However, i was not able to ping those secondary ip addresses from other devices residing in the same subnet...can you try using ip addresses from different subnets in your test lab?

Toshi_Esumi

SuperUser

I just tested the creation of three secondary IPs. Didn't connect to anywhere else. What do you see in sniffing like
"diag sniffer packet [interface_name]"
when you pinged from the other side (Cisco side)? Are those ping packets coming in?

Toshi

Toshi_Esumi

SuperUser

Ok, I think you just need to allow ping on those secondary IPs.

config secondaryip
edit 1
set ip 192.168.2.1 255.255.255.0
set allowaccess ping
next

Toshi

KemoAuthor

Visitor III

and i also think i may have confused the verbiage a bit as there is a difference between a "secondary" ip address and a "sub-interface". the secondary is an ip address, in addition to, the primary ip address with no trunk involved. On the other hand, a Sub-Interface requires that you define a VLAN ID. I have been able to define many sub-interfaces. also, the port on the cisco switch where im using sub-interfaces is trunked. all devices are communicating in the respective vlans work without issue. With the exception of anything on VLAN 1. i cannot define a sub interface using VLAN 1 that works. ideally, i would have a redundant interface with sub-interfaces for each VLAN i need to service. so far, im at a loss as i cant get it to work with a single port, much less a redundant link.

Toshi_Esumi

SuperUser

Not exactly sure about the "sub-interfaces" on the Cisco switch you're talking about. Can you share some switch config?

FGTs don't have (or not allowed) VLAN1. The physical interface config is for untagged interface. Then when you configure those VLAN "sub-interfaces" on the physical (or aggregated) interface, it acts as a trunk port.

Toshi

KemoAuthor

Visitor III

i will explain the best i can with the simplest test i did. I have a single cable coming from port1 on the Fortigate to the Cisco switch. this port is set to trunk in Cisco.

On the fortigate port, i have configured a few vlan interfaces with vlans 2 and 3.

i have a device plugged into the Cisco and this port is set to VLAN2.

I have another device plugged into the Cisco and this port is set to VLAN3.

And finally, i have a device plugged into the Cisco that has not had any configuration and is in VLAN1 by default.

i have ping enabled on the vlan interfaces under port 1 and i can ping back and forth from the fortigate to the devices within their respective Vlans.

When i attempt to add another VLAN interface using VLAN1, i am not able to ping back and forth on VLAN1. the other devices in VLAN2 and VLAN3 continue to work just fine.

on a side note, I was able to delete the VLAN1 interface under port1 and add an ip address from the VLAN1 range and was able to ping the device in VLAN1 without issue. So it seems that in order to communicate on VLAN1 you must use a physical port and not a VLAN interface (which i was calling a sub-interface). I was then able to add secondary ip addresses to the physical port1 under the primary interface without issue.

is this the expected behavior or is it possible to build a VLAN interface using VLAN1 under a physical port?

thanks again for all your help, Ive been learning alot about how all this fits together.

Steve

Sign up

Login with SSO

Login to the community

Login with SSO