Fortigate internal network to vlan routing

[Narita_Kong]

I've a fortigate 100A with internal interface 192.168.1.1/24 which connect to two 3com switch with two vlan with VLAN1 (192.168.20.0/24) and VLAN2 (192.168.30.0/24)

I created with two sub-interface on internal interface "vlan20 -192.168.20.1" and 1"vlan30-92.168.30.1" and policy allow both vlan network access each other, external network and internal interface network,

also allow external network and internal interface network access to vlan network. 

My PCs form VLAN1 and VLAN2 can ping each other and access my internal interface network 192.168.1.1/24 

but my pc form internal interface network cannot access to both VLAN netowrk

i try trace route 192.168.20.0/24 or 192.168.30.0/24 network found that the packet pass my gateway 192.168.1.1, it goes directly to external network and will not route to the vlan.

do i need to add static routes for the internal interface on my fortigate100A  and how should i do?

Thank you 

[Christopher_McMullan]

Creating a VLAN sub-interface automatically creates a connected route on the FortiGate for that subnet when you define an address for the interface.

Could you run a flow trace to show the routing decisions made on the traffic?

diag debug reset

diag debug enable

diag debug flow show console enable

diag debug flow show function-name enable

diag debug flow filter addr w.x.y.z //--use either a source or destination address, so long as the policies do not translate it

diag debug flow filter proto 1 //--if you use ping to test connectivity

diag debug flow trace start 5000

<attempt to ping from internal to VLAN, then...>

diag debug flow trace stop

diag debug flow filter clear

diag debug reset

diag debug disable

[Toshi_Esumi]

Also "get router info routing-t all" would help to make sure the connected routes are there. It sounds like routing related because it seems to be following the default route.

[b_row]

Hello. By default the FortiGate internal interface uses the VLAN ID 1 untagged; However must have entered into conflict with the VLAN 1 the network 192.168.20.0/24 the switch 3com, for in the FortiGate you reported that created the VLAN20 for the network 192.168.20.0/24. Hope this helps