Interface causing another Interface to go down?

[rholguin]

FortiGate 500D version 5.2.3

I have 2 outside interfaces configured, both with STATIC IP on the same subnet.  I enabled the subnet overlapping to allow this.

Interface 9 (Outside IP) -----------------------> Interface Interface 15 (DHCP Server - 1 server behind it)

Interface 10 (Outside IP) -----------------------> Interface Interface 16 (DHCP Server - 0 server behind it currently)

The issue I am having is that when Interface 10 is up, after some time it will cause the Interface 9-15 to get really bad.  The server on 15 cannot ping, cannot load or serve any web pages.  Connection over SSH works, but its very slow.  For the ping issues, I cannot PING my server remotely and when I SSH into my server I cannot ping out either.

The moment I unplug or turn down Interface 10, then my server suddenly starts working again.  I turn Interface 10 back on again and everything continues to work great, then eventually 9-15 goes bunk again in which I Have to reboot 10 again.

During the times when my connection is not working properly, I have tried removing all policies in the system relating to Interfaces 10 and 16 in case something is interfering somehow but that does not change anything.  The 10 reboot is still required to get my connection back.

Anyone have any ideas?  Is there any debug commands I can post the output to help solve this?

[gschmitt]

Why do you have 2 interfaces within the same subnet?

[Johan_Witters]

Sounds like a bug to me, you might need to open a support ticket for this.

But I agree that it is a strange config, overlapping subnets should be used with caution and as short as possible. I would suggest to get the 2 systems connected behind the same interface if possible.

[rholguin]

We have about 5 dedicated app/db servers and we have a network of fileservers/backup units.  The idea was that we would separate them to their own interface in hopes to limiting any bottleneck or interference of traffic.  If were getting heavy app traffic we don't want that negatively affecting the traffic of our users accessing the fileservers or vise versa.  I only have 1 subnet available to me in my location so I have 2 static IP's on the same subnet.

Though I'm far from a networking expert so perhaps that is the wrong way of thinking.  If this doesn't work out my other option was to just have the one external static IP but have each group on their own internal network interface.  We also had hopes of adding another static IP (same subnet again) and dedicate that port to web admin access only.  We would put a firewall in front of that port to really lock down access...but it appears that won't happen either.

Either way, it sucks that this option is available yet doesn't work properly.

[gschmitt]

Two possible solutions:

If it's just about the interface bottle neck enable a software switch

Make sure all References to the interfaces are removed and click "Create new" select switch and select the interfaces you want

You could have a dedicated interface per server with one single IP for the fortigate, keep in mind that in this configuration the firewall aspect of the device will not work (since the traffic doesn't really go through the firewall)

Another way would be to create seperate subnets, you can split your existing subnet (assuming you got something like the tradicional 192.168.0.0/255.255.255.0) into two different subnets.

Set the internal interface to 192.168.0.1/25 which gives you the range of 1-126 on one end.

Either put the servers on a software switch with the IP 192.168.0.129/25 which gives you the range of 129-254 on the other end

You could (if you want a subnet per server and not use the software switch) also seperate the subnet yet again with something like 192.168.0.129/30 giving you 2 IPs per subnet.

If you need a refresher on subnetting: http://www.subnet-calculator.com/

That way you can apply UTM profiles on the connections.

You can also create a VIP within the first subnet and reroute traffic based on port on the same IP (as in 192.168.0.55 on http goes to server A but ftp goes to server B)

Just tell me what you want and I could draw it up for you

[Johan_Witters]

If you want to separate the app servers from the other servers it's better to connect them on a separate switch.

Next create a software switch on the Fortigate, and connect your switches (1 with the app servers, and 1 with the other servers) to the ports configured in the softswitch. That way most of your traffic streams will be separated, but you'll be able to have all in the same subnet.

If you need added bandwidth between the Fortigate and the switches, you'll need to configure an aggregated link (802.ad)