Technical Tip: VLAN 1 Sub-Interface is not working over a Trunk Link

[yloo]

Description	This article describes an issue where a FortiGate sub-interface configured with VLAN 1 does not receive traffic.
Scope	FortiGate, Third-party switch.
Solution	The issue occurs because most switches treat VLAN 1 as the native (untagged) VLAN on trunk links. FortiGate, however, requires VLAN 1 traffic to be tagged on its sub-interface, and untagged traffic will be sent or received on the physical interface. This mismatch prevents traffic from reaching the FortiGate unless the switch configuration is adjusted. To resolve the issue, change the native VLAN on the switch to a dummy VLAN (for example, VLAN 999), which is a VLAN not used anywhere else in the network. This ensures VLAN 1 traffic is sent as tagged across the trunk. SW1#configure terminal SW1(config)#interface gi0/1 SW1(config-if)#switchport mode trunk SW1(config-if)#switchport trunk native vlan 999 SW1(config-if)#switchport trunk allowed vlan 1,10,20 Reference: FortiGate requires all VLAN sub-interfaces—including VLAN 1—to receive 802.1Q-tagged frames for proper operation.