Hello everyone,
Before implementing the following configuration in production I'm testing it out in GNS3 and I'm facing issues with Inter-VLAN routing. I have configured FortiGate to act as router-on-a-stick.
Please, find the attached images for the reference. I believe I'm not missing anything here. Any suggestions would be helpful.
Network Diagram:
Firewall Polices:
VLAN Interface details:
Sniffer Output:
Thank you
IMPORTANT UPDATE:
Hey everyone,
This is important I guess,
I just replaced the new FortiGate running FortiOS 7.2 with ForiOS 6.4.9. And, Inter-VLAN routing is happening now without any problem.
I have same configuration in place like the one that I had earlier.
Is this a bug or anything in 7.2 release? Can the Fortinet staff confirm this please?
Please find my updated screenshots:
PC1 to PC2:
PC2 to PC1:
Thank you
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi Chethan,
I tested this on a 7.2 device and it is found to work, so issue should be local to your environment only.
best regards,
Jin
Hi, I have mentioned you in another similar reply.
Thank you
Hi,
looking at the sniffer echo request reaches the firewall but did not leave it.
Form my experience, 99% I had a similar issue it was either routing or firewall policy.
I understand no routing is required as both vlans are directly connected.
And from the other screenshot firewall policy looks good, too.
But have you checked the logs on the Fortigate, anyway? Does the log is showing any denies?
Are you sure the objects used in the policy have the correct IP configured?
Because that has happened to me multiple time. Object name looks good but the IP configured in that object had an error like two digits in the wrong order or something.
Created on 05-12-2022 04:41 AM Edited on 05-12-2022 04:48 AM
Hello,
I have enabled all logs, but I do not see any violation logs there.
Yes, The objects are configured correctly. Those are subnet address type. I have attached the screenshot in my previous replies.
Hi SveN2,
I have updated my original post. Kindly, check!
Thank you
Hi Chethan,
It appears like FortiGate itself not able to reach 10.0.200.10 in first place, did you check? Is it possible to gather the below debug flows while pinging 10.0.200.10,
#diag deb reset
#diag deb flow filter trace start 5
#diag deb flow filter proto 1
#diag deb flow filter add 10.0.100.10
#diag deb flow show con en
#diag deb flow show fun en
#diag deb con time en
#diag deb en
Best regards,
Jin
but 10.0.200.254 is a vlan interface on the FortiGate - how can the FGT not reach its own interfaces?
--
"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
edited the original post, it was meant to be 10.0.200.10 instead.
Best regards,
Jin
Hi,
I have updated my original post. Kindly, check!
Thank you
FortiGate is able to reach both the end devices in both VLANs.
I have replaced FortiGate 7.2 with FortiGate 6.4.9 and it is working.
I have updated my original post. please check.
Thank you
Hi Chethan,
If you upgrade the new FortiGate 6.4.9 to 7.2 following upgrade paths, are you hitting the same issue?
Best regards,
Jin
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1547 | |
1031 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.