Technical Tip: Virtual-Wire for PPPoE traffic

FortiGate

FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.

Article Id 269838

Description

This article describes how to configure the Virtual-Wire in FortiGate for passing through the PPPoE traffic.

Scope

FortiGate.

Solution

Topology:

Create the virtual-wire:

Ornstein-kvm32 (PPPoE-VW) # show

config system virtual-wire-pair

edit "PPPoE-VW"

set member "port3" "port4"

end

Enable l2forward and broadcast-forward in the interfaces of the virtual-wire:

config system interface

edit "port3"

set broadcast-forward enable

set l2forward enable

edit "port4"

set broadcast-forward enable

set l2forward enable

It is not necessary to configure the 'Firewall Virtual Wire Pair Policy'.

FortiGate cannot recognize the packets encapsulated in PPP which is a Layer 2 protocol between two routers directly without any host or any other networking in between:

'l2forward' and 'broadcast-forward' must be enabled to force forwarding the packets.
The 'Firewall Virtual Wire Pair Policy' needs the IP/MAC in the packets to match the traffic, which is not suitable for the PPP Layer 2 traffic.