Unable to connect to devices on same subnet

The title of this message is somewhat confusing :) Am i right in presuming that you are using A VLAN trunk to the switch from the internal interface? and that you are NOT using the DMZ interface, but instead an VLan subinterface? On that presumption, then you will need to have the internal interface also assigned a vlan ID as well as the DMZ sub interface. then routing between the two will work, as long as you have rules to allow it. So if you are trying to connect from internal vlan1 to DMZ vlan2 for example, then you will need have firewall rules to allow it, so an INT -> DMZ allow and a DMZ -> INT for the other direction. But, its unusual to have a core switch on the DMZ... and if its a true DMZ, then you wouldnt want any DMZ -> INTERNAL traffic allowed.

The title might be confusing because I' m confused!! I' ll try to be a little more concise. /edit - The exact error from pinging the units from 192.168.40.x to 172.16.4.x is " Reply from 192.168.40.1: Destination host unreachable" , implying the internat interface can' t find a route to 172.16.4.x /edit The DMZ isn' t really being used as such. The VLAN sub-interface (call it the MGMT interface) on the DMZ port has the address of 172.16.4.1 on Vlan 2. The physical Internal interface has the address of 192.168.40.1. It is not a Vlan, but the actual, physical interface. I have policies allowing all traffic from any souce to any destination on the MGMT interface from the Internal interface, as well as the converse (for troubleshooting purposes). In effect, the firewall should be wide open between the two interfaces. I' m not sure I understand your suggestion, but here goes... With the above setup, the Internal interface needs to be a Vlan interface? Is that accurate? If so, how do I make it so? Would I have to create a Vlan sub-interface below it? I don' t understand how making it a Vlan will help traffic flow between the two interfaces. In any case, I appreciate your help. I' m dead in the water with this one!! Cheers.

if you create a vlan sub-interface, then the cable to the port needs to go to a switch that is configured to have it as a vlan trunk port. without that you cannot use sub-interfaces, they are purely for vlan usage. you can omit the vlan ID on the native interface, only if your switch also supports the native vlan ID traffic. What exactly are you trying to achieve? What you have configured is if the switch its connected to has multiple vlans within it, and you want the fortinet to provide the routing between them. But as stated above, that connecting switch port must be trunk enabled (ie be set for tag for at least the internal vlan and dmz vlan. If the DMZ sub-interface is purely for firewall mgmt, then whats the point?