Hello everyone,
I am running a Fortigate with FortiOS v7.4.5, where the default VLAN traffic arrives untagged on the LAN interface. Currently, several networks (e.g., 10.0.1.0/24 and 10.0.2.0/24) are operating over this interface.
After assigning a secondary IP address to the interface (10.0.1.3/24), routing between the two subnets works as expected. However, the security policies configured between these networks are not being enforced.
I have reviewed some relevant articles, but the suggested solutions do not seem to resolve the issue. According to these Fortinet Technical Tips, the traffic should be blocked by default and then allowed through the appropriate policies:
I have tested this in a lab environment, and as expected, the traffic between the subnets is routed, but the configured security policies are not being applied.
Is this behavior expected? Are there any alternatives, or is there something missing in the configuration?
Thank you in advance for your help.
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
TAC has found the solution to the problem:
Traffic handled by FortiGate for packet w... - Fortinet Community
Thank you everyone.
Hi
Try with a software switch with explicit intra switch policy.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Software-switch-policy/ta-p/198381
Another method that "should" work is to put the interface in a zone with denied intra zone traffic, the create a policy to allow the required traffic.
Yes even if they are on the same VLAN ID, the systems don't know about anything outside of their configured subnet and will send all other traffic to the default gateway. The only difference is that they are all in the same broadcast domain. I won't rant about the ridiculousness of this because I'm sure you are already aware.
Thanks for your reply.
I configured the software switch in explicit mode, but routing between networks is blocked, and even after allowing traffic, the rules aren't applied. When using zones, traffic flows, but deny rules still don't work, just like before.
Is the only solution to move each network to a different interface or segment them into VLANs?
Also, what’s the purpose of those technical tips if they don’t seem to apply here? I'd like to understand that.
You can read more about firewall policies on same interface in this article. This is not recommended and can be used temporarily usually during a migration phase.
Using VLANs under the physicals interface (sub-interface) when a switch connects is the quickest way to isolate the hosts in L2 and easy apply in firewall policy as a dedicated interface:
Hello,
thank you for your reply. Unfortunately, this solution hasn’t resolved the issue either. When I try to modify rule 0, instead of updating it, a new rule is added with an ID different from 0, and the situation remains unchanged. The routing works correctly, but when I try to block traffic between one IP and another, or between different subnets, it doesn’t work. I’ve run several tests in the test environment, but the problem persists in every scenario.
You are still going if the configuration that includes a single interface with the secondary IP right?
The rule 0 is just used for CLI configuration without risking to overwrite an existing rule. Try to order the newly created policy in the top and make sure that the hosts are using the FGT as their default gateway and not some other network device in the network. You can do a simple packet capture to that interface to verify that this traffic is indeed going through FGT.
TAC has found the solution to the problem:
Traffic handled by FortiGate for packet w... - Fortinet Community
Thank you everyone.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1705 | |
1093 | |
752 | |
446 | |
230 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.