Hello!
I'm moving from Juniper to Fortigate and I'm having issues setting up subinterfaces.
I have setup a port 3 VLAN subinterface with VLAN tag 704 (port 3 IP is 0.0.0.0/0.0.0.0):
edit "port3"
set vdom "root"
set type physical
set snmp-index 7
edit "port3/3.6"
set vdom "root"
set ip 10.2.4.1 255.255.255.0
set allowaccess ping https ssh
set description "z_DB"
set snmp-index 35
set interface "port3"
set vlanid 704
Then I have done static route as well:
edit 35
set dst 10.2.4.0 255.255.255.0
set device "port3/3.6"
next
When I try to ping the fortigate unit from a MacBook Pro that is connected directly to Fortigate 800C port 3 and I gave the mac a static ip 10.2.4.22, then added VLAN 704 interface as well with ip 10.2.4.23. Now when I ping the fortigate unit the ping does not go through and fortigate unit does not show anything when I try to debug address 10.2.4.1
diag debug reset
diag debug enable
diag debug flow filter addr 10.2.4.1
diag debug flow show console enable
diag debug flow trace start 100
When I change the port 3/3.6 ip to 10.2.10.1 and add ip 10.2.4.1 directly to port 3 interface then the diag shows me that policy is blocking access and that's the way I want it to be.
I also tested so that I added port 3/3.6 to VLAN 500 (same as my office switch ports have) and connected it to switch and the computer to switch as well. Still nothing. Sniffer does not show that any packets are coming in from port 3/3.6 or to ip 10.2.4.1 when the ip is given to port 3/3.6 (subinterface). When the ip is given to port 3 directly then sniffer and flow debug show me that policy is blocking the traffic.
Where could the problem be? I can show you my configuration as well if needed.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi,
The subinterface act as a trunk. I think you should use a switch between your PC and fortigate.
Regards,
Radu
Technically, it is NOT the subinterface (I assume you refer it to as the VLAN interface) acting as a trunk.
In this case, it is port3 acting as a trunk.
BTW, we do not recommend using special characters, such as "/", "\" and "[space]" in the name of any objects.
[ FortiGate ] ---- port1 -----> untagged packets VLAN1 -----> tagged packets
vjoshi wrote:I added switch between them and reconfigured port 3/3.6 to use VLAN id 500 as my office switches are configured. Connected the fortigate to switch and 2 computers to the switch as well.
Hello, A VLAN interface is attached to a physical interface. When the FortiGate sends out traffic to the physical interface level, the egress packets are untagged, whereas the packets sent on a VLAN level are tagged. If on a particular VLAN there are destination devices in the network that do not accept tagged packets, it will be required to connect the FortiGate to an intermediate L2 device (a switch for example) configured with the same VLAN(s). Example with a FortiGate with VLAN id 1 attached to port1:[ FortiGate ] ---- port1 -----> untagged packets VLAN1 -----> tagged packets
Comp 1: 10.2.4.22
Comp 2: 10.2.4.24
Ping worked.
When I try to ping fortigate 10.2.4.1 from 10.2.4.22 it says the host is down.
When I use diag debug flow on address 10.2.4.22 when I ping it from 10.2.4.24 then fortigate shows no action about anything. Neither does when I try to ping 10.2.4.1 from 10.2.4.24, still says the host is down.
I guess it shouldn't act like this because ping is not allowed from policy's for 10.2.4.X from anywhere even its own subnet.
It should still show that the ping has been blocked.
Am I right?
I am sorry, I am not sure about your requirement.
- But the current configuration looks to be fine and you should be able to ping the Fortigate(10.2.4.1) from those 2 machines :
Comp 1: 10.2.4.22 Comp 2: 10.2.4.24
- Firewall policy doesn't have any effect now if the traffic is between the hosts on same VLAN
Please explain the exact requirement now and I would recommend to use the below filter for the debug flow while testing with ICMP traffic(provided there are not many ICMP request on this network):
diag debug reset diag debug enable diag debug flow filter proto 1 diag debug flow show console enable diag debug flow trace start 100
Cheers
vjoshi wrote:I am sorry, I am not sure about your requirement.
- But the current configuration looks to be fine and you should be able to ping the Fortigate(10.2.4.1) from those 2 machines :
Comp 1: 10.2.4.22 Comp 2: 10.2.4.24
- Firewall policy doesn't have any effect now if the traffic is between the hosts on same VLAN
Please explain the exact requirement now and I would recommend to use the below filter for the debug flow while testing with ICMP traffic(provided there are not many ICMP request on this network):
diag debug reset diag debug enable diag debug flow filter proto 1 diag debug flow show console enable diag debug flow trace start 100
Cheers
Basically I want to make a subinterface for 10.2.4.X subnet with VLAN ID. Then add static IP's for hosts (10.2.4.X). Then I want to be able to ping FG unit from that subnet. I guess I'm going to setup a old switch for test env. and connect it to fortigate and 2 pc's to it in local network. Will also TAG the vlans. I will keep you posted.
I think your not understand vlan tagging,
1: do yo have a switch between the port3 and pc
2: is the switch configured for the vlan(S) that matches the fortigate subinterfaces
3: is the PC/host in the correct vlan-id
4: if you have a switch can you share the fortigate and pc port cfgs
Now if you have NO switch and the PC/HOST is connected to port3 directly, you need tagged the packets directly for that vlan-id
PCNSE
NSE
StrongSwan
emnoc wrote:When I had mac connected directly to port 3 and VLAN setuped on mac then the packets were tagged, because mac os x vlan setup is using tagged packets by default. Still no ping worked and FG did not see anything.I think your not understand vlan tagging,
1: do yo have a switch between the port3 and pc
2: is the switch configured for the vlan(S) that matches the fortigate subinterfaces
3: is the PC/host in the correct vlan-id
4: if you have a switch can you share the fortigate and pc port cfgs
Now if you have NO switch and the PC/HOST is connected to port3 directly, you need tagged the packets directly for that vlan-id
Hello!
I got it working. My bad on the ping side from MacBook to Fortigate. I did not use the right source address for ping and now everything works. The problem was I was first pinging from non VLAN interface, once I changed to VLAN source everything started to work :)
Thanks everybody for the help!
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1703 | |
1092 | |
752 | |
446 | |
229 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.