InterVlan Routing - Not all VLAN Interfaces are on the Fortigate

[tbar1704]

I created my first VLAN Interface on the Fortigate, under the LAN port that goes to our core switch. The LAN port to the HP Switch is a Trunk port and the new VLAN is permitted on the trunk port.

For now all the other VLAN interfaces are on the Layer 3 Core Switch

I cant ping the new VLAN's interface from the Core switch directly or by one of the resources I have on the new VLAN connected to the Core switch

[ebilcari]

If the point to point interfaces can ping each other, make sure to include routes (static or a routing protocol) on both FGT and the L3 Switch for the respective subnets.

[tbar1704]

I have a static route on the Layer 3 Core switch that looks like:

  ip route-static 0.0.0.0 0.0.0.0 10.255.254.254

where 10.255.254.254 is the IP for the LAN interface on the FG

[Toshi_Esumi]

Does the L3 switch have the same VLAN with an IP like 10.255.254.253 configured? Otherwise it wouldn't route.

Toshi

[tbar1704]

The L3 switch does have a VLAN Interface configured for the 10.255.254.0 subnet (10.255.254.1). The L3 switch does not have a VLAN Interface configured for the new VLAN but it does have a VLAN Interface.

[Toshi_Esumi]

So you're saying the 10.255.254.0/24 is non-tagged interface on both sides (or native vlan on the SW).

I would sniff on the interface if any packets come in or go out when you sends packet from either side. I'm assuming you have a pair of policies between the non-tagged interface and the new VLAN subinterface on the FGT. Otherwise nothing would go accross between two interface(subinterface)s.

• parent (non-tagged) interface -> VLAN subinterface
• VLAN subinterface -> parent (non-tagged) interface

Toshi

[tbar1704]

10.255.254.0 is the Native VLAN on the switch port

I added theses rules

Name                                 From           To                Source   Dest   Service
VLAN 210 - Out to LAN     VLAN 210   LAN             All           All      All
VLAN 210 - In from LAN   LAN             VLAN 210   All            All      All

I can now ping the new VLAN Interface from the Core switch (10.1.210.1) but I'm unable to ping resources on the VLAN from the Core switch or the Firewall

Do I need a VLAN Interface on the Core switch too?

[Toshi_Esumi]

Where is the "resources" connected to? Directly to the FGT? You said that VLAN doesn't exist on the core switch, right?

[tbar1704]

The resources are downstream off the core switch on the new VLAN. The resources are on different distribution switches connected to the core switch and are all able to see each other. So the VLAN exists on the Core switch

I have no VLAN Interface for the new VLAN on the Core switch

[Toshi_Esumi]

it's confusing me. You said you could ping from the core SW(10.1.210.1). Isn't it on the VLAN 210, and its the L3 interface?