I've a fortigate 100A with internal interface 192.168.1.1/24 which connect to two 3com switch with two vlan with VLAN1 (192.168.20.0/24) and VLAN2 (192.168.30.0/24)
I created with two sub-interface on internal interface "vlan20 -192.168.20.1" and 1"vlan30-92.168.30.1" and policy allow both vlan network access each other, external network and internal interface network,
also allow external network and internal interface network access to vlan network.
My PCs form VLAN1 and VLAN2 can ping each other and access my internal interface network 192.168.1.1/24
but my pc form internal interface network cannot access to both VLAN netowrk
i try trace route 192.168.20.0/24 or 192.168.30.0/24 network found that the packet pass my gateway 192.168.1.1, it goes directly to external network and will not route to the vlan.
do i need to add static routes for the internal interface on my fortigate100A and how should i do?
Thank you
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Creating a VLAN sub-interface automatically creates a connected route on the FortiGate for that subnet when you define an address for the interface.
Could you run a flow trace to show the routing decisions made on the traffic?
diag debug reset
diag debug enable
diag debug flow show console enable
diag debug flow show function-name enable
diag debug flow filter addr w.x.y.z //--use either a source or destination address, so long as the policies do not translate it
diag debug flow filter proto 1 //--if you use ping to test connectivity
diag debug flow trace start 5000
<attempt to ping from internal to VLAN, then...>
diag debug flow trace stop
diag debug flow filter clear
diag debug reset
diag debug disable
Regards, Chris McMullan Fortinet Ottawa
Also "get router info routing-t all" would help to make sure the connected routes are there. It sounds like routing related because it seems to be following the default route.
Hello. By default the FortiGate internal interface uses the VLAN ID 1 untagged; However must have entered into conflict with the VLAN 1 the network 192.168.20.0/24 the switch 3com, for in the FortiGate you reported that created the VLAN20 for the network 192.168.20.0/24. Hope this helps
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1710 | |
1093 | |
752 | |
447 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.