Interface mode ports - passing traffic between them

[mmacpuguy]

Folks, simple question I have two interfaces and devices attached with statically set IP addresses in the same scope (they talk fine when attached to a switch or crossover cable) what policy / route to I need to have the Fortigate allow traffic between them? Here is what I' ve tried. I' ve set port 3 and port 4 to have any/any/all/all policies between them. no dice Thanks!

[Dave_Hall]

Off the top of my head... - you may have enabled NAT between the two interfaces, in the firewall policy - you only have one firewall policy configured when two may be need (eg. port a -> port b, port b> port a) - One (or both) of the interfaces have a forced duplex speed set and it is not able to communicate properly with one of the connected devices. If the latter, you could always set the interface to auto sense the duplex/speed from the CLI via...

 
 config system interface
     edit " portx" 
       unset speed
     next
 end
 

Edit: if the devices on both interfaces are suppose to be on the same subnet then the two interfaces should be on the same switch interface. IMO.

[mmacpuguy]

Dave, thanks for the reply. NAT is not enabled, good thought though. I do have two policies so between them in both directions it' s any.any.all.all The interfaces both indicated UP, but I' ll try the speed suggestion. BUT, I' m not crazy right - this should work with ease? (I' ve even used a crossover cable between the devices and they talk fine.)

[rwpatterson]

Using a crossover cable will work fine because they are on the same subnet. Crossing a router will not work for the same reason. The traffic is trying to reach the ' remote' device, but any node on the network sees that the device is ' local' and will not even try the default gateway. Why should it? It' s supposed to be on the ' local' LAN...same subnet.

[Dave_Hall]

This is why I suggest the two interfaces be on the same (soft) switch interface. Not sure, but I think you can still create a soft switch even if the Fortigate is placed into Interface mode.

[mmacpuguy]

Yes, I get it. If you wanted to use this configuration how would you set the routes? Example Port 3 device 10.10.10.10 Port 4 device 10.10.10.11 What would the routes look like? Thanks guys!

[mmacpuguy]

A little more on this. BTW the reason I' m doing this is that I' m swapping out a Fortigate which is used in Transparent mode with a much larger one that I' m going to use in NAT mode. But I would like to not have to redo my network scheme at this time.

[rwpatterson]

Couldn' t you just hang a switch off of the port that has multiple devices?

[mmacpuguy]

I could, but then couldn' t manage traffic between them. The answer turned out to be a CLI only command to allow subnet overlap. Thanks for the ideas everyone.

[rwpatterson]

There were consequences when enabling that setting. I don' t recall what they were, but they affect the security of the device to an extent.