FortiGate VLAN subinterface not working

[Rait]

Hello!

I'm moving from Juniper to Fortigate and I'm having issues setting up subinterfaces.

I have setup a port 3 VLAN subinterface with VLAN tag 704 (port 3 IP is 0.0.0.0/0.0.0.0):

edit "port3"
        set vdom "root"
        set type physical
        set snmp-index 7

edit "port3/3.6"
        set vdom "root"
        set ip 10.2.4.1 255.255.255.0
        set allowaccess ping https ssh
        set description "z_DB"
        set snmp-index 35
        set interface "port3"
        set vlanid 704

Then I have done static route as well:

    edit 35
        set dst 10.2.4.0 255.255.255.0
        set device "port3/3.6"
    next

When I try to ping the fortigate unit from a MacBook Pro that is connected directly to Fortigate 800C port 3 and I gave the mac a static ip 10.2.4.22, then added VLAN 704 interface as well with ip 10.2.4.23. Now when I ping the fortigate unit the ping does not go through and fortigate unit does not show anything when I try to debug address 10.2.4.1

diag debug reset
diag debug enable
diag debug flow filter addr 10.2.4.1
diag debug flow show console enable
diag debug flow trace start 100

When I change the port 3/3.6 ip to 10.2.10.1 and add ip 10.2.4.1 directly to port 3 interface then the diag shows me that policy is blocking access and that's the way I want it to be.

I also tested so that I added port 3/3.6 to VLAN 500 (same as my office switch ports have) and connected it to switch and the computer to switch as well. Still nothing. Sniffer does not show that any packets are coming in from port 3/3.6 or to ip 10.2.4.1 when the ip is given to port 3/3.6 (subinterface). When the ip is given to port 3 directly then sniffer and flow debug show me that policy is blocking the traffic.

Where could the problem be? I can show you my configuration as well if needed.

[rdumitrescu]

Hi,

The subinterface act as a trunk. I think you should use a switch between your PC and fortigate.

Regards,

Radu

[dingjerry_FTNT]

Technically, it is NOT the subinterface (I assume you refer it to as the VLAN interface) acting as a trunk.

In this case, it is port3 acting as a trunk.

BTW, we do not recommend using special characters, such as "/", "\" and "[space]" in the name of any objects.

[vjoshi_FTNT]

Hello,   A VLAN interface is attached to a physical interface.  When the FortiGate sends out traffic to the physical interface level, the egress packets are untagged, whereas the packets sent on a VLAN level are tagged.   If on a particular VLAN there are destination devices in the network that do not accept tagged packets, it will be required to connect the FortiGate to an intermediate L2 device (a switch for example) configured with the same VLAN(s).   Example with a FortiGate with VLAN id 1 attached to port1:

[ FortiGate ]  ---- port1 ----->  untagged packets                         VLAN1 ----->  tagged packets    

[Rait]

vjoshi wrote:
Hello, A VLAN interface is attached to a physical interface.  When the FortiGate sends out traffic to the physical interface level, the egress packets are untagged, whereas the packets sent on a VLAN level are tagged. If on a particular VLAN there are destination devices in the network that do not accept tagged packets, it will be required to connect the FortiGate to an intermediate L2 device (a switch for example) configured with the same VLAN(s). Example with a FortiGate with VLAN id 1 attached to port1:

[ FortiGate ]  ---- port1 ----->  untagged packets                       VLAN1 ----->  tagged packets

I added switch between them and reconfigured port 3/3.6 to use VLAN id 500 as my office switches are configured. Connected the fortigate to switch and 2 computers to the switch as well.

Comp 1: 10.2.4.22

Comp 2: 10.2.4.24

Ping worked.

When I try to ping fortigate 10.2.4.1 from 10.2.4.22 it says the host is down.

When I use diag debug flow on address 10.2.4.22 when I ping it from 10.2.4.24 then fortigate shows no action about anything. Neither does when I try to ping 10.2.4.1 from 10.2.4.24, still says the host is down.

I guess it shouldn't act like this because ping is not allowed from policy's for 10.2.4.X from anywhere even its own subnet.

It should still show that the ping has been blocked.

Am I right?

[vjoshi_FTNT]

I am sorry, I am not sure about your requirement.

- But the current configuration looks to be fine and you should be able to ping the Fortigate(10.2.4.1) from those 2 machines :

Comp 1: 10.2.4.22 Comp 2: 10.2.4.24

- Firewall policy doesn't have any effect now if the traffic is between the hosts on same VLAN

Please explain the exact requirement now and I would recommend to use the below filter for the debug flow while testing with ICMP traffic(provided there are not many ICMP request on this network):

diag debug reset diag debug enable diag debug flow filter proto 1 diag debug flow show console enable diag debug flow trace start 100

Cheers

[Rait]

vjoshi wrote:

I am sorry, I am not sure about your requirement.

- But the current configuration looks to be fine and you should be able to ping the Fortigate(10.2.4.1) from those 2 machines :

Comp 1: 10.2.4.22 Comp 2: 10.2.4.24

- Firewall policy doesn't have any effect now if the traffic is between the hosts on same VLAN

Please explain the exact requirement now and I would recommend to use the below filter for the debug flow while testing with ICMP traffic(provided there are not many ICMP request on this network):

diag debug reset diag debug enable diag debug flow filter proto 1 diag debug flow show console enable diag debug flow trace start 100

Cheers

Basically I want to make a subinterface for 10.2.4.X subnet with VLAN ID. Then add static IP's for hosts (10.2.4.X). Then I want to be able to ping FG unit from that subnet. I guess I'm going to setup a old switch for test env. and connect it to fortigate and 2 pc's to it in local network. Will also TAG the vlans. I will keep you posted.

[emnoc]

I think your not understand vlan tagging,

1: do yo have a switch between the port3 and  pc

2: is the switch configured for the vlan(S) that matches the  fortigate subinterfaces

3: is the PC/host in the correct vlan-id

4: if you have a switch can you share the fortigate and pc port cfgs

Now if you have NO switch and  the PC/HOST is connected to port3 directly, you need tagged the packets directly for that vlan-id

[Rait]

emnoc wrote:

I think your not understand vlan tagging,

1: do yo have a switch between the port3 and  pc

2: is the switch configured for the vlan(S) that matches the  fortigate subinterfaces

3: is the PC/host in the correct vlan-id

4: if you have a switch can you share the fortigate and pc port cfgs

Now if you have NO switch and  the PC/HOST is connected to port3 directly, you need tagged the packets directly for that vlan-id

When I had mac connected directly to port 3 and VLAN setuped on mac then the packets were tagged, because mac os x vlan setup is using tagged packets by default. Still no ping worked and FG did not see anything.

[Rait]

Hello!

I got it working. My bad on the ping side from MacBook to Fortigate. I did not use the right source address for ping and now everything works. The problem was I was first pinging from non VLAN interface, once I changed to VLAN source everything started to work :)

Thanks everybody for the help!