I have a Cisco core switch which is the one in charge of routing the internal traffic between VLANs everything in the internal communication is working fine I mean VLAN 20 has communication to any other VLAN in my organization nevertheless I added a VLAN interface in my Fortigate 600C with FortiOS 5.0 build 0271 Patch 6
config system interface edit "VLAN 20" set vdom "root" set ip 10.1.20.2 255.255.255.0 set allowaccess ping https set snmp-index 35 set interface "port1" set vlanid 20 next end
when I try to ping from a pc in the subnet and VLAN 20 gaves me the following error:
# diagnose debug flow show function-name enable # diagnose debug flow filter addr 10.1.20.3 # diagnose debug flow filter proto 1 # diagnose debug flow trace start 100 # id=13 trace_id=549 func=resolve_ip_tuple_fast line=4299 msg="vd-root received a packet(proto=1, 10.1.20.3:1->10.1.20.2:8) from VLAN 20." id=13 trace_id=549 func=init_ip_session_common line=4430 msg="allocate a new session-09c10f2f" id=13 trace_id=549 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed, drop" id=13 trace_id=550 func=resolve_ip_tuple_fast line=4299 msg="vd-root received a packet(proto=1, 10.1.20.3:1->10.1.20.2:8) from VLAN 20." id=13 trace_id=550 func=init_ip_session_common line=4430 msg="allocate a new session-09c10f73" id=13 trace_id=550 func=fw_local_in_handler line=360 msg="iprope_in_check() check failed, drop"
The interface from the core switch to the fortigate is in trunk mode.
I have read that when you add a subinterface in the fortigate you dont need to add a static route in the fortigate in order to ping to internal network, since is directly connected to the switch core. Is this correct?
What am I missing here?
Thanks in advance,
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Have you put any IP restrictions on trusted Hosts for your admin accounts?
Have you put any IP restrictions on trusted Hosts for your admin accounts?
Thanks Anne, that was my problem.
By the way any advice in communicating VLANs.
I have multiples VLANs and my core switch is routing all traffic through native VLAN 1 to the WAN through a physical interface in the Fortigate for example port 1 with ip address 10.1.0.90 in the same port I created the VLAN 20 and VLAN 30 Interfaces.
I have already created policies from VLAN 20 to VLAN 30 and vicecersa in order to test inter VLAN communication with no luck I cant ping to VLAN 20 interface in Fortigate with an Ip address 10.1.20.2 from a PC with ip adress 10.1.30.3 in VLAN 30.
Thanks for your help.
Would you be able to draw it on a piece of paper and upload here. That will help us to understand the scenario ..
Just checking, Have you installed the Fortigate in transparent mode??
Anne thanks for your help.
I have created a new thread.
VLANs cant go to the internet.
https://forum.fortinet.com/tm.aspx?m=122896&tree=true
I appreciate your help.
Best Regards,
Luis
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1696 | |
1091 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.