One VLAN, multiple subnets issue

[FortiKnight]

Hello everyone,

I am running a Fortigate with FortiOS v7.4.5, where the default VLAN traffic arrives untagged on the LAN interface. Currently, several networks (e.g., 10.0.1.0/24 and 10.0.2.0/24) are operating over this interface.

After assigning a secondary IP address to the interface (10.0.1.3/24), routing between the two subnets works as expected. However, the security policies configured between these networks are not being enforced.

I have reviewed some relevant articles, but the suggested solutions do not seem to resolve the issue. According to these Fortinet Technical Tips, the traffic should be blocked by default and then allowed through the appropriate policies:

• Allow traffic between different subnets with the same VLAN
• How to allow traffic when using the same logical interface

I have tested this in a lab environment, and as expected, the traffic between the subnets is routed, but the configured security policies are not being applied.

Is this behavior expected? Are there any alternatives, or is there something missing in the configuration?

Thank you in advance for your help.

[AEK]

Hi

Try with a software switch with explicit intra switch policy.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Software-switch-policy/ta-p/198381

Another method that "should" work is to put the interface in a zone with denied intra zone traffic, the create a policy to allow the required traffic.

[zeucqu2]

Yes even if they are on the same VLAN ID, the systems don't know about anything outside of their configured subnet and will send all other traffic to the default gateway. The only difference is that they are all in the same broadcast domain. I won't rant about the ridiculousness of this because I'm sure you are already aware.

[FortiKnight]

Thanks for your reply.

I configured the software switch in explicit mode, but routing between networks is blocked, and even after allowing traffic, the rules aren't applied. When using zones, traffic flows, but deny rules still don't work, just like before.

Is the only solution to move each network to a different interface or segment them into VLANs?

Also, what’s the purpose of those technical tips if they don’t seem to apply here? I'd like to understand that.

[ebilcari]

You can read more about firewall policies on same interface in this article. This is not recommended and can be used temporarily usually during a migration phase.

Using VLANs under the physicals interface (sub-interface) when a switch connects is the quickest way to isolate the hosts in L2 and easy apply in firewall policy as a dedicated interface: