Connect different network IP Segment - Fortigate60E

[razer8388]

Hi

In my office, there have two different subnet. 192.168.78.x and another one is 192.168.58.x. Each of them are connect to the different router and different firewall, and one of them are using fortigate 60e. 

My question is, if I pull one cat 6 cable as a backbone to connect between this subnets, via fw, what is the feature that I can use at fortigate 60e to allow this two subnets communicate.

Thank you

[sw2090]

You need three "Features".

- an interface (physical or vlan) 

- a route to each Subnet 

- policies that allow the traffic 

and you wil need this on BOTSubmit PostH sides!

[razer8388]

Thank you for the suggestion but previously I have done all the configuration as per mentioned but I cannot ping to each other.

For routing I use static route to create the route for the subnet. I have read some of the suggestion from other forum to use policy route instead of static route.

[sw2090]

It works with static routes, I have several different subnets behind several FGT here and I can access all of them even troough IPSEC Tunnel. And I only use static routes.

Did you set route and policy on BOTH Sides? 

What did you ping? If you want to ping your FGT from remote subnet you have to make sure that ping on that interface of your FGT is enabled too!

[razer8388]

Yes I set static route and create the policy to allow the traffic on both side firewall. I ping to the remote subnet from the fortigate.

[sw2090]

hm then probabvly a diag debug flow may help you to debug where your traffic goes. 

I don't know which firewall oyu have on opposite side but on FGT goes lilke this:

diag debug flow show console enable

diag debug flow filter <filter>

diag debug flow trace start/stop <numberofpackets>

diag debug flow filter ? shows you details on the filters.

Probably you need something like

diag debug flow filter daddr <theipyoupingfromthefgt>

then you will see where your traffic goes and which policy applies ;)

[sw2090]

Oops prolly you need 

diag debug enable 

too :)

Just forgot it...

[razer8388]

Thank you for the post. Will do debug and update it. :)