InterVlan Routing - Not all VLAN Interfaces are on the Fortigate

[tbar1704]

I created my first VLAN Interface on the Fortigate, under the LAN port that goes to our core switch. The LAN port to the HP Switch is a Trunk port and the new VLAN is permitted on the trunk port.

For now all the other VLAN interfaces are on the Layer 3 Core Switch

I cant ping the new VLAN's interface from the Core switch directly or by one of the resources I have on the new VLAN connected to the Core switch

[tbar1704]

Sorry for the confusion

I created the VLAN Interface on the FG using the IP Address 10.1.210.1

From the Core switch console I can ping the VLAN interface that exists on FG but I'm unable to ping any resources on the 10.1.210.0 subnet. Also, none of those resources can ping the 10.1.210.1 IP

[Toshi_Esumi]

Let's put aside the issue pinging from the SW itself. So you're saying you can't ping from like 10.1.210.2/24 device connected to the SW to 10.1.210.1 on the FGT VLAN interface, and the FGT can't ping 10.1.210.2 either. Right?

I think the problem is on the SW side but to make sure, just sniff packets on VLAN 210 interface at the FGT while you're pining from the 10.1.210.2 device to 10.1.210.1. If you don't see nothing coming in, the SW is not forwarding the VLAN traffic.
To test opposite direction, you need have two sessions, or one SSL and another console, then sniff it while pinging 10.1.210.2. You should see the ping/ICMP requests go out but you might not see responses coming back.

Toshi

Toshi

[Toshi_Esumi]

Oh, by the way, recently(last week) we had a thread about a VLAN connection issue with HPE/Comware switch. It turned out it was a switch native vlan config issue that the native vlan is needed to be included in permit vlan list on the trunk port.

You're sure about your switch trunk port vlan config, right? HPE has multiple SW platforms with different OS so depending on the model you have the problem above might not apply.

[Toshi_Esumi]

Probably that's not a matter because VLAN 210 is NOT a native VLAN in your case. Sorry. Just ignore my comment above.

[ebilcari]

First try to ping the next hop (10.255.254.254) from the switch, if that is reachable than you have to add a static route also from the FGT to the new subnet you created on the switch. Make sure to also create a firewall policy on the FGT to allow the traffic.

[tbar1704]

The new subnet (VLAN) is on the FG not the switch

[ebilcari]

I would suggest to draw a schema of the physical and logical interfaces and the subnets that you want to route, right now it's a bit confusing what you are trying to achieve (routing via next hop, spanning VLAN from SW to FGT or a mix of it)

[tbar1704]

I think what I'm missing is a static route on the switch....

[Toshi_Esumi]

@tbar1704I didn't realize it was you again for the same switch I commented last week. As I said yesterday, when you sniff on the "VLAN 210" subinterface, and you see it's sending the packets from 10.1.210.1 to those "resources" in the same VLAN on the switch, there is a disconnection on the switch between the trunk port 4/0/23 and those VLAN 210 access ports (I'm assuming). 

Toshi

[tbar1704]

@Toshi_Esumi  - Yes, it's me again/still. Adding the Native VLAN 4000 to the trunk port 4/0/23 fixed my first issue, now I've moved on and I am stuck again.

I believe the issue is on the switch side. From the switch console I can ping the VLAN 210 Interface (10.1.210.1) but not from any resources in VLAN 210.

I'm assuming I need a static route 10.1.210.0 255.255.255.0 10.1.210.1. However, I already have a static route that says 0.0.0.0 0 10.255.254.254.

Is there a method to order the static routes so not everything uses 0.0.0.0 0 10.255.254.254?