Fortigate 60F - VLAN interface as default gateway stop responding pings from hosts.

[eastehr]

Good morning experts. Maybe you want to help me with a problem that is killing me..?

I’m trying to configure a solution for a remote office using CISCO switches and a Fortigate 60E. Difficult to explain but that is almost fixed, no problem with that.

The problem is a behavior about how Fortigate manage VLANs in its Internal ports hard-switch:

When all infrastructure is connected, the testing host is able to ping all VLANs. But when a physical trunk link is down between two of the Cisco Switches, the testing host loses connection to its default gateway (which is the Fortigate...!) I mean that the testing host can ping 5/6 time more from the moment the link goes down and after that it loses connection and pings are not more answered until the link is reestablished.

I drew my infrastructure so that it is understood, I hope you can help me.

Technical data:

* Interfaces used: ports 1 to 5 of the Internal hardware-switch

* Five VLANs configured on it: IDs 15, 30, 35, 50, and 101.

* VLAN 50 has DHCP server configured.

* Testing host is connected to a single port on a Cisco Switch configured on VLAN50

* Cisco Switch is connected to Internal 03 port of the Fortigate.

Pls, refert to the following image:

** UPDATE** I have ran a debug flow diagnostic, and found the following log:

Packet Trace #43 2024/07/18 14:21:53 checked gnum-10000e policy-4294967295, ret-matched, act-drop

How to solve it..? I guess that policy is a default policy, not configurable... :(

[tunolno1]

So the WAN 10.1.128.1 that is a different machine so would not a ping from 192.168.3.2 say go through 192.168.3.1 then 10.1.128.18 then to 10.1.128.1? no ? So the Want machine would just need to know to toss it back from whence it came through .18 no https://mobdro.bio/ ?

[eastehr]

Im sorry tunolno1, I can't understand you reply, I never mentioned those IP addresses. But is not a routing issue at all. Thanks a lot for your support.

[eastehr · Accepted solution]

I discovered the solution for myself. Im going to share it for the community: The problem wasn't in the Fortigate itself, but in the first Sw Cisco where the testing host was connected to. In that Cisco Sw the STP (Spanning Tree) was enable for VLAN 50 (Vlan used by the testing host). When I disabled it, all start to work as expected. 

Thank to those who had the oportunity to evaluate my problem. Regards.