- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Fortigate and Fortiswitch - Vlans
Hi all.
I have a problem to proper configure FG and FS.
I have
iternet modem
|
| (vlan100)
|
switch (cisco)
|
|(vlan100)
|
switch (fortiswitch)
|
|(vlan100)
|
fortigate
When I use Cisco SG-300 (instead Fortiswitch), and configure port to untagged vlan 100 every things works ok.
But when i change to Fortiswitch native vlan 100, thats not working.
I have fortilink beetwen FG(port7) and FS(port48).
Trunk beetween FS and Cisco SW works ok.
I use port 6(vlan100) on FS and port WAN1 on FG.
Vlan 1 is working ok, beetween FG(port1) and FS(port1).
What can be wrong?
FG v. 6.0.4
FS v. 6.0.2
FS managed from FG.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you show the cisco config? Remember Cisco has different meaning for Untag Native vlan VS Access port. You can have untagged traffic going over your trunk port, which is not tagged; however, I am not fully understanding your issue, but I would like to help.
When you say "remove switch for cisco" does that mean you remove the Fortigate switch that is behind the Cisco switch?
Please sent the Cisco config of the switch ports you are using.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for replay.
gradius85 wrote:When you say "remove switch for cisco" does that mean you remove the Fortigate switch that is behind the Cisco switch?
Now i have -> modem - cisco(sw) - cisco(sw) - Fortigate. I want change the cisco switch (connected to fortigte) to fortiswitch.
Cisco port configuration where all is ok
"interface gigabitethernet45
description "uplink vlan 100" switchport trunk native vlan 100 !"
Fortiswitch conf for this port
edit "port6" set native-vlan 100 set igmp-snooping disable set snmp-index 6 next
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you need the 'trunk native vlan 100'? Can you get away with just an Access Port? Or do you have a need to see/tag all traffic except v100 traffic?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
it must be in vlan 100. It can be in access port in vlan100, but when I change Vlan100 in FG to access it also does not working.
I have read somewhere
"You must configure the proxy ARP with the config system proxy-arp CLI command to be able to use the access VLANs. "
But i really don't understand why i need to do it.
In cisco switch all working, but in FS not.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Proxy ARP...That seems very odd, since you do not need the device to answer the ARP, since you are not using it for routing. However, maybe the Fortigate needs to ARP for the Modem, so the firewall interface is getting your public IP assigned.
Is your modem a cable modem, and are you trying to apply the IP on the WAN side of the Fortigate firewall?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is the router witch has own ip address x.x.x.33, FG on WAN1 has x.x.x.34
On cisco switch all works ok.
I have notice one more error, when Wan1 FG is connected to port6 on Fortiswitch, all network are terrible low.
So with configuration FS is something bad.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When you say vlan from your "internet modem" - is the Modem tagging the traffic with vlan100 802.1q tags? Or are you just showing that you want that traffic to be part of vlan100?