Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
thepip3r
New Contributor

200E - Setting up a port to plug into a vSwitch port for isolated management

remote firewall config

[ul]
  • config system settings   set allow-subnet-overlap enable[/ul]

    vSwitch config

    [ul]
  • interface-address: 10.1.2.1/29
  • member ports:  2, 3, 4, 5[/ul]

    Port 6 config

    [ul]
  • plugged into port 2 (vswitch)
  • type: LAN
  • interface-address:  10.1.2.3
  • services-checked:  ping, ssh, http, https[/ul]

     

     

    I can ping 10.1.2.1 and 10.1.2.3 from the CLI on the remote firewall.  I can ping 10.1.2.1 from the local firewall CLI but cannot ping 10.1.2.3.  Is the problem related to 10.1.2.3 not having a default gateway pointed to 10.1.2.1?

     

    My routing encompasses 10.1.2.3 on the 10.1.2.0/29 network so I'm not sure what's wrong.  Any assistance would be appreciated.

     

    Ultimately, I'm trying to set up a dedicated 'management port' without using the OOB Management-named port.  If I'm going about this the wrong way, please let me know.

     

    Thanks!

  • 1 REPLY 1
    thepip3r
    New Contributor

    In an effort to make this a little bit more clear, I'm trying to set up an isolated management interface (not the OOB Management interface) on a 'management' network.  

     

    With a physical layout, this does work:  

    [ul]
  • Port1 (Isolated Management interface), ping+ssh+http+https, 192.168.0.2/29, plugged into a port on the physical switch
  • Port2 (Black Network Gateway), ping, 192.168.0.1/29, plugged into a port on the physical switch
  • Admin Laptop, 192.168.0.3/29, plugged into a port on the physical switch[/ul]

    From the admin laptop, I can ping both 0.1 and 0.2 and https into 0.2.

     

    With a virtual layout, it does not work:

    [ul]
  • Port1 (Isolated Management interface), ping+ssh+http+https, 192.168.0.2/29, plugged into a port2 on the virtual switch
  • Port2 + Port3 (joined as a vSwitch), ping, 192.168.0.1/29
  • Admin Laptop, 192.168.0.3/29, plugged into port3 on the virtual switch[/ul]

    From the firewall CLI, I can ping 192.168.0.2.  Even if I change to 'exec ping-options source 192.168.0.1', I can still ping 192.168.0.2.  

     

    From the laptop, I can ping 192.168.0.1 but I cannot ping 192.168.0.2.  If I put a network tap between the laptop and port3, I can see the workstation ARP for the MAC of 192.168.0.2 but it doesn't get a response.

     

    I thought maybe the interfaces didn't use AutoSense technology, so the cable that connects Port1 to Port2, I replaced with a crossover cable and even though the firewall still showed the port as green and I could still ping 192.168.0.2 from the CLI, I could not ping from the workstation.  

     

    It's almost as if the vSwitch isn't maintaining a MAC Address table... can anyone provide any insight into this?

     

    TIA!

     

     

     

     

  • Announcements

    Select Forum Responses to become Knowledge Articles!

    Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

    Labels
    Top Kudoed Authors