Creating Fortigate subnets vLAN's for VMWare hosts.

[eloderichs]

Hello,

I am new to Fortigate and I am sure I am missing something here. To be honest, not even sure wether it is a Fortigate or VMWare problem.

Here is my case: My Fortigate 60D is directly connected to two vmware 6.x hostservers. Not using any another physical switch, just the internal 7+1 hardware ports switch on the Fortigate.

On the VMWare hostservers there need to be separate networks. So I choose to use 172.16.0.0 (255.255.255.224) giving me about 23 possible subnets with 30 hosts, like this;

subnet  0    255.255.255.224    172.16.0.1 - 172.16.0.30    subnet  4    255.255.255.224    172.16.4.1 - 172.16.4.30    subnet  8    255.255.255.224    172.16.8.1 - 172.16.8.30     and so on.

So the internal Fortigate interface (and gateway) is set to 172.16.0.30. The subnets 4,8, and 12 were created as vLAN's. On the vmware server I use a standard virtual switch. Subnet 0 is used for the internal hardware (server NIC's, HP ilo port, storage server and so on.) A firewall object and security policy was created for this subnet. Al hosts are able to commicate witheach othe and to the outside world. This works fine.  

For the other subnets different vlan's (port groups in vmware terminology) are created. In each subnet I used the last (.30) address as the default gateway for that particular subnet. These VM's are able to communicate with each other but not to the outside world. Created a Firewall object and Policy for these subnets, on the same way I did that for the internal network 0. But only the internal subnet 0 is able the reach the outside world.

Now what am I missing here? Is this even possible without an extra switch?

I hope someone is able to see the problem. Thanks in advance.

Eric Loderichs

[tanr]

FortiGate vlan interfaces only work with vlan tagged packets.  On the VMWare side, are the actual physical nics on your vmware host properly configured to pass the 802.1Q vlan tags?  And to receive vlan tagged packets?  How that's done seems to be a little different for every vendor, and to use slightly different terminology.

Assuming your vlan tags are getting sent through from the VMs, and should be received okay by the VMs, how is your FortiGate set up, and what version of FortiOS do you have?

On the FortiGate you've got multiple vlan interfaces created, with the proper VLAN ID, on top of the correct physical interfaces?  And whatever IP you've listed for the vlan interfaces is set to be the default gateway for that interface from your VM side?

Assuming all that is the case, and that your vmware subnets match the subnets they need to talk to on the FortiGate, how about a simple test.

Before you dig into issues with security policy rules, DHCP, DNS etc., can you turn on *only* administrative access PING for one of the vlan interfaces, then try to ping the vlan's IP from a VM that should be able to access that vlan? That should let you make sure that you're at least getting to the FortiGate from the VM.

[eloderichs]

Hello tanr,

Thanks for the reply. Glad to hear that what I want is possible. Let me update;

1. Physical nics vmnic0 and vmnic1 are the onboard nics on my HPDL360G6 hostservers. I can see that the driver is " bnx2 ". But after a lot of research I 'm not sure  802.1q vlan tags are supported by these nics. Presume they will but keep looking for more info.  

2. Fortigate setup. Operating mode is NAT. A VLAN VM Network 4 (172.16.4.1/255.255.255.224) was created under the wan1 interface as (public IP) well as under the internal network 172.16.0.30/255.255.255.224) both without result. Used the exact phrase in VMWare als in the Fortigate "VM Network 4".

- Firewall object "VM Network 4" Interface Any. Type subnet

- Policy VM Network 4 - wan: Source all, Destination all, schedule always, http+ https, Ping

3. FortiOS. Firmware version is v.50, build310 (GA Patch 11)

4.On the FortiGate I have multiple vlan interfaces created, with the proper VLAN ID. Used the physical wan 1 interface as well as the internal  physical interface, both without result, should be wan I presume. After initally using the first IP in tht subnet I later changed it to the .30 number which is used as the gateway for that subnet. No result.

What I do I ping to the outside world (8.8.8.8) from a test VM in that subnet, For this moment all that the VMs  have to do is see each other and the outside wolrd, and vice versa.

Really appreciate your help. New to fortigate, as you have proberly guessed.

Eric

[tanr]

1. If you've got an HP ProLiant DL360 G6 I would assume any nics that come with it can handle 802.1Q vlan tagging.  A quick web search shows it as 8021.Q compliant.  Note that the vlan interfaces from the FortiGate will only work with tagging, they don't do untagged vlans.

2. I don't think you want a (layer 2) vlan interface on your public facing wan port.  Along with other problems, your upstream router will likely drop anything that isn't set to the default vlan 0.  When you say you also have the same vlan set for your internal network, do you mean you've set it on a virtual-switch or switch-interface with that name?  There are some big differences between FortiOS 5.0, 5.2, and 5.4 for this - see my comment on #3 below.

With the 60D and older versions of FortiOS you need to figure out how your internal switch mode is set.  See http://kb.fortinet.com/kb/documentLink.do?externalID=FD37588 and https://blah.cloud/infrastructure/changing-fortigate-switch-mode-interface-mode/ for brief overviews.  

Note that with FortiOS 5.4 the set type switch-vlan is rather different.  See https://forum.fortinet.com/tm.aspx?m=139834 for a discussion.

3. FortiOS 5.0.11 (build 310) is pretty old, especially if it's a FortiGate 60D.  Is there a reason you haven't upgraded it to 5.2.x or 5.4.x?  I'm not familiar with 5.0.x.

4. I think you need to simplify this so that you can test each part separately on the FortiGate side before you pull in the VM side.  On the FortiGate set a vlan 99 interface on an internal physical interface, NOT the wan interface and NOT any internal switch interface.  Turn on admin access for ping on the vlan 99 interface (set allowaccess ping, or append allowaccess ping). Take a managed switch that can handle vlan tagging and connect it to the single physical port on the FortiGate which has the vlan 99 interface.  Set that particular port on the switch to be vlan 99 tagged only.  Set another port on the switch to be vlan 99 untagged. Hook a laptop to the vlan 99 untagged port, then see if you can ping the vlan 99 interface IP.  Once you can do that, you can set up test security policies to allow wan access for vlan 99 and verify it works from the laptop.  Then you can try adding in communication between vlans, with more vlans on the fortigate and the managed switch and another laptop.

Good luck!

[eloderichs]

Hi,

A quick reply. Again thanks will move on from here.

For your information, I recently bought 2 used and identical Fortigate 60D appliances. One is now already setup in a datacenter (not in production yet but working for the internal LAN) and the other is here on my Lab desk to play around with.

Totally agree of coarse that you dont want a switch on the Public wan. But that is not the case. If the VLAN is placed under the wan then there is still NAT I presume. Anyway thanks for the warning.

Now the internal LAN switch is serving the hardware as mentioned. Technically not a VLAN I guess. But if I understand you well I better return to .99 and use the vlan 99. Ok will try to do that.

First thing I did was upgrading the firmware with the Fortiexplorer app. Was under the impression that I was up to date now, ok so I was wrong :-). Will try to update them again now, although they are out of their maintenaince. Maybe I can find it somewhere. Did notice the differences with all the youtube instructional video's. 

Ok Will keep you posted about the progress.

Eric