Configure vlan sub-interface as gateway for all other vlan client

[azwanarif]

Hi All,

I have post on creating sub-interface and create a firewall policy for inter-vlans communication which connect direct with access switch using trunk port. All communication between client and interface was successfully establish and functioning.

However customer goal is to use one sub-interface ( VLAN 3) as gateway for all other VLAN clients. Since the fortigate unit is located at customer place, we are unable to performed further testing and simulation. We would like to know if this method is plausible and if anyone has experience configured the same method. 

Lan Port (hardware switch)

Vlans 1 IP 10.101.1.254  - Client IP 10.101.1.x/255.255.255.0

Vlans 2 IP 10.101.2.254  - Client IP 10.101.2.x/255.255.255.0

Vlans 3 IP 10.101.3.254  - Client IP 10.101.3.x/255.255.255.0

Vlans 3 IP 10.101.7.254  - Client IP 10.101.7.x/255.255.255.0

Vlans 4 IP 10.101.10.254 - Client IP 10.101.10.x/255.255.255.0

Vlans 5 IP 10.101.11.254 - Client IP 10.101.11.x/255.255.255.0

Vlans 6 IP 10.101.12.254 - Client IP 10.101.12.x/255.255.255.0

[hubertzw]

I'd ask your customer why they wanted VLANs? Probably for the isolation purpose. L2, to be effective, shouldn't be large.

It doesn't make sense to separate something first and then expect to share some pieces, like default gateway in your case.

Do you know what is the reason behind? Why they do not want to use a separated default gateways per vlan?

[azwanarif]

Hi hubertz, Appreciate the the feedback, what customer told us is that he prefer to separate and network for easier manage/documentation. since I don't have access to the firewall I'm using gns software and simulate the environment. As mention above the simulation is successful. However when change the client (tiny Linux) gateway, client can't reach the firewall and I'm not sure whether the system have limition or missing policy to achieve the goal.

[hubertzw]

azwanarif wrote:
However when change the client (tiny Linux) gateway, client can't reach the firewall

Can you explain what did you change exactly?

[brycemd]

I'm not 100% sure I understand the objective, but I think you want all clients to use the same gateway regardless of what subnet they are in?

That's not going to fly. Gateway needs to be in the same subnet. That's networking 101.

[sw2090]

Your clients already do that ;)

They all use your Fortigate as gateway for traffic that is not intra-subnet.

As brycemd says u cannot use a default gw that is in a different subnet. I know no device at all that would acept such default route....

All you then need would be policies to allow the traffic (and static routing if it's not traffic bound to physical or vlan or vpn interfaces or the internet)