Moving Virtual Interfaces from Layer 3 switch to Fortigate - Adding Virtual Interfaces to Fortigate

[tbar1704]

Currently our Fortigate is connected to an Access Port on our Core Switch tagged with VLAN 4000. The Core Switch has all our Virtual Interferfaces configured on it with no restrictions on what VLANs can see/access other VLANs.

The core switch has a static route "ip route-static 0.0.0.0 0.0.0.0 10.255.254.254" where 10.255.254.254 is the IP Address of the Fortgate port (Port 4) connected to the Access Port on the Core Switch

The ultimate goal is to move all Virtual Interfaces to the Fortigate se we can start doing segementation.

For now I just want to add a new VLAN/VLAN Interface to the Fortigate so I can segment that.

     - I created the new VLAN / VLAN Interface under Port 4 on the Fortigate (VLAN 210) 

     - I created a new trunk port on the Core Switch that looks like this

          interface GigabitEthernet4/0/24
            port link-mode bridge
            description Trunk to Firewall LAN
            port link-type trunk
            port trunk permit vlan 210 4000

When I move the LAN connection from Port 4 on the Fortigate from the Access Port on the Core Switch to the new trunk port on the Core Switch the LAN loses all connectivity to the Fortigate. I'm assuming it has something to do with the trunk port I created but I don't know what I'm missing

Thank you

[spoojary]

f you set VLAN 4000 as the native VLAN on the trunk port, make sure the corresponding interface on the FortiGate also treats VLAN 4000 traffic as untagged/native. Configure VLAN 210 as a tagged VLAN on the FortiGate.

[Toshi_Esumi · Accepted solution]

The VLAN 4000 is NOT a tagged interface on the fortigate port4 because the switch port is "access". The switch was stripping the tag for VLAN 4000 traffic before sending to the FGT.

With the new trunk port, the VLAN 4000 is now tagged, which the FGT port4 doesn't have the VLAN interface configured.

Two options.

Option1: This is what @spoojary is assuming. If the switch supports native VLAN per port, you can set the new trunk port's native VLAN to 4000.

Option2: Rip the L3 config from port4 and create a new VLAN 4000 subinterface on the FGT then put it on the port4. To do this you likely need to remove all policies and other config referring port4, then recreating them with the new VLAN 4000's name.

Toshi

[tbar1704]

 ?

[tbar1704]

Thank you both for the responses. Setting the Native VLAN made sense.

I add the VLAN 4000 as the Native VLAN on my new trunk port (PVID 4000) and when I moved the connection over I lost Internet access.

I have a small percentage of my Address Object assigned to the Interface LAN (port 4). A colleague suggested those interfaces need to be removed?

thoughts?

[Toshi_Esumi]

That shouldn't cause this type of problem. You just can't mix objects assigned to specific different interfaces, or "any", together in one policy.
Sniff traffic at the FGT Port4 when you send packets from VLAN 4000. I'm guessing it's still tagged with 4000, and you would see it (content is hid) in the sniffing.

Toshi

[Toshi_Esumi]

If you sniff the parent interface without filter, VLAN tagged traffic would show up like below (VLAN 201):
fgxxx-utm (root) # diag sniffer packet wan
interfaces=[wan]
filters=[none]
pcap_lookupnet: wan: no IPv4 address assigned
1.200000 802.1Q vlan#201 P0
1.201753 802.1Q vlan#201 P6
1.429195 802.1Q vlan#201 P0
1.429272 802.1Q vlan#201 P0
1.508286 802.1Q vlan#201 P0
1.508327 802.1Q vlan#201 P0
^C

[tbar1704]

The parent interface is port4 and its alias is LAN. When I try to run the comand in the CLI I get this:

fgxxx-utm # diag sniffer packet lan
interfaces=[lan]
filters=[none]
pcap_activate: No such device exists for lan

I'm assuming I should run the command using port4 as the interface?

[Toshi_Esumi]

What interface has 10.255.254.254? Can you share the part of config under "config sys int"? Does your FGT have "lan" hard-switch or soft-switch interface including port4?

Toshi

[tbar1704]

Thank you Toshi

edit "port4"
set vdom "root"
set ip 10.255.254.254 255.255.255.0
set allowaccess ping https ssh snmp fgfm
set type physical
set alias "LAN"
set device-identification enable
set role lan
set snmp-index 6