Fortigate to Palo Alto reachable

[vishal]

Hi team, I'm doing a testing lab in my environment as per attached scenerio Switch having an SVI of subnet 192.168.230.0/24, 10.2.2.0/24 Where my switch is connected on fortigate internal port1 IP (192.168.230.1) using ip 192.168.230.254. And fortigate is connected to Palo Alto using L3 link using internal port 3 IP (10.1.1.2) and same is configure on Palo Alto link connected to fortigate ip (10.1.1.1). Whereas fortigate and palto directly connected L3 link can ping each other. My problem is when I assigned vlan 20 of 10.2.2.0 subnet to my laptop I can reach fortigate L3 link ip 10.1.1.2 but can't reach palto Alto 10.1.1.1 Route on Palo alto To reach 10.2.2.0 next hop 10.1.1.2( fortigate L3 link) Policy Internal zone to internal zone policy is created Eg:- source 10.1.1.1/24 to destination 10.1.1.1/24 Route on fortigate To reach 10.2.2.0 next hop 192.168.230.254( switch directly connected link). Ipv4 policy Internal 1 (192.168.230.0/24) source 10.2.2.0/24 to internal 3 (10.1.1.2/24) destination any and same vice versa is created. Policy route Internal 1 (192.168.230.0/24) source 10.2.2.0/24 forwarding interface internal 3 (10.1.1.2) gateway 10.1.1.1( Palo Alto directly connected link ip) and same vice versa is created. Can anyone please help me what I'm missing here Any help will be appreciated. Regards, Vishal

[brycemd]

So is VLAN20 an interface on the fortigate? Or is routing through the switch? ie, what is the gateway for 10.2.2.0

If it's on the fortigate your policy/rules need to define the VLAN as the interface rather than Internal1.

If it's on the switch, does the switch have the proper routing setup?

Also, policy routes shouldn't be needed in either case.

[vishal]

Brycend, Vlan 20 is an SVI on switch. Yes vlan 20 is routing through the switch and reaching fortigate on internal port1 IP (192.168.230.1). Also on fortigate I have done reverse route for 10.2.2.0/24 via 192.168.230.254( switch management IP).

[hubertzw]

You said you have a route on the FortiGate to vlan20 via 192.168.230.254.So if I good understand the path is:

Laptop->SVI 10.2.2.0/23-> SVI 192.168.230.254->port1 (192.168.230.1)-FG-port3 (10.1.1.2)-> PAN 10.1.1.1

You need a route on the switch: subnet 10.1.1.0/24 via 192.168.230.1

and on the FortiGate you need the route: subnet 10.2.2.0/24 via 192.168.230.254 (I think you have this one) and firewall policy: port1 -> port3, from 10.2.2.0/24 to 10.1.1.0/24

On PAN you need a route: subnet 10.2.2.0/24 via 10.1.1.2

Can you upload the network diagram?

[vishal]

Hubertwz, Thank for your reply. As per your suggestion I need a route on the switch: subnet 10.1.1.0/24 via 192.168.230.1, but already on my switch there's a default route towards 192.168.230.1. I think it should work if not please correct me. Also on fortigate ipv4 policy is port1 -> port3, from 10.2.2.0/24 to all (I think "all" should cover 10.1.1.0/24) where 10.1.1.0/24 subnet lies on Palo Alto inside zone. Please correct me if I'm wrong somewhere Regards, Vishal

[hubertzw]

What about routing on PAN? It has to know where (gw 10.1.1.2) to send packets with destination 192.168.230.0/24 and 10.2.2.0/24.

Can you ping from PAN to one of SVIs on the switch? For this you need a new policy port3->port1