We have a splitted subnet:
LAN2: (physical interface)
172.29.6.1/255.255.255.128 for FortiAP's
Wi-Fi SSID:
172.29.6.129/255.255.255.128
I have connected a cabled physical device and given static ip details:
ip: 172.29.6.201
gw: 172.29.6.129
sub: 255.255.255.128
Was hoping I could reach this device from the Wi-Fi clients, but no good. All good when connected to cable though. Where am I going wrong here?
-PM
*edited LAN1 to LAN2
Hi pmh,
yes, you are correct. FortiGate implicitly denies traffic between separate interfaces, even if they should be in the same subnet. You would have to create a policy from lan2 to your SSID, and would have to ensure that the server IP is within the subnet for lan2, not the SSID subnet, otherwise traffic will fail on the reverse routing check.
One way around the policy requirement would be to create a software switch out of the interfaces (the SSID and lan2 interface) and have a single interface IP and subnet on those two interfaces. You would have to roll back some IP configuration to put lan2 and the SSID into a switch interface, though.
Another option would be to switch the SSID to bridge mode (instead of tunnel mode), that way the SSID is essentials considered part of the physical interface the access point is connected on (it achieves the same result as creating a software switch).
In tunnel mode, the SSID is considered an entirely separate (virtual) interface from LAN2, and communication from anything in WiFi is tunnelled via CAPWAP; you essentially have two completely different connections on LAN2.
You could also put the SSID and lan2 into a zone, and allow intra-zone traffic, that would also eliminate the need for a policy. However, as there is no shared subnet between lan2 and the SSID, you would still need to update the server IP to ensure it is within the lan2 /25 subnet to prevent traffic failing on a routing check.
If you are unsure what the routing check is:
When FortiGate receives the first packet in a session, it does a basic sanity check to verify that a reply to that IP would go back out the interface it received the packet on.
In your case:
- FortiGate receives a packet with source IP .201 on lan2
- it checks its routing table to determine where it would send replies TO the IP .201
- it sees that the .201 IP belongs to the SSID subnet, not lan2, so the routing does NOT check out
- it denies the packet based on reverse path check failure
- this is intended as a basic check to prevent IP spoofing
I hope this helps :)
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
