FortiGate 60F with unmanaged switch, some wired clients have no internet access

[automanual]

I am a home user and have very little knowledge on firewall settings. 

FW: FortiGate 60F v7.0.11 build0489

Network switches: 1. tp-link TL-SG1016 (unmanaged), 2. Netgear GS110TUP PoE (managed), 3. Netgear GS116 (unmanaged), 4. Ubiquiti minis (managed), 5. Ubiquiti PoE (managed)

AP: Aruba 535s

FortiGate is essentially on default setting with problematic devices connected on VLAN1 (default).

managed switches have the correct VLAN IDs.

all wifi clients have proper IPs, and have full access to the internet

I am able to access the APs and managed switches

setup 1: FortiGate to switch 1 to switch 2 to switches 4 & 5s.

connected wired devices at switches 4/5: Mac, Apple TV, Roku, raspberry Pi, Sonos speakers, and some other computers.  These wired clients have the network/internet access at either switch 4 or 5, except raspberry Pi has no internet access.  Pi when directly connected to switch 2, 4, or 5; I am able to "see" and control it with some simple commands, but no internet whatsoever. 

Also, Synology NAS connected at switch 1 has no internet access nor I can access the device locally.  All working wired devices seem to have IP addresses. 

I am able to see the pi and NAS on DHCP monitor (FortiGate), but it does not seem to assign IPs to these two devices.  I have full access to the FortiGate from both wired Mac and wired/wireless PC.

setup 2: FortiGate to switch 1 to switch 2 to switch 3/switch 4.

I am able to access the FortiGate but none of the wired clients have the internet access.

I thought the problem was the unmanaged switches so I tried this...

setup 3: FortiGate to switch 5 to switch 2 to switch 4.

the same issue as the setup 1, and I am unable to access my FortiGate... so this setup wasn't good.

Currently I went back to the setup 1 and trying to figure out why only some wired devices have no access to the internet.  I read on forums and tried different setups for the last 6 days but I can't seem to figure this issue out.  

Could it be that anything directly connected to an unmanaged switch are considered as the unmanaged switch as a whole?  Is it possible to force FortiGate to treat devices connected to an unmanaged switch (directly or indirectly) as clients so that the device receive an IP address?

One thing I noticed: unlike Ubiquiti USG and other devices I have used, the FortiGate is very sensitive to the sequence and time in which network switch is connected... but I am done with the USG.

I would like to use as much unmanaged switches as possible with the exception of the PoE switch 2 (to power the APs).

please help.

thanks

FortiGate 

[akristof]

Hello,

Do you see incoming traffic on Firewall? Quick pcap will show you if traffic is received. When it is, then you can troubleshoot further to see if any policy needs to be added, etc.

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Packet-Capture-on-FortiOS-GUI/ta-p/1...

https://docs.fortinet.com/document/fortigate/6.2.13/cookbook/54688/debugging-the-packet-flow

[automanual]

yes, there is traffic.

i think it has something to do with the unmanaged switches and vlan settings... but i don't know what.  if i connect a managed ubi switch (4 or 5) downstream of the netgear PoE (2), the wired devices have the internet access. but if i place the switch 4 or 5 upstream of the switch 2, the whole network goes down.  

IGMP snooping and RSTP enabled on switches 2, 4, and 5.

thanks

[gfleming]

We need a topology diagram. It's a bit confusing that you have a mix of managed and unmanaged switches.

What is doing the inter-VLAN routing? I assume not the FortiGate since you say it's on "default" settings (i.e. routing LAN-to-WAN and that's about it).