One VLAN, multiple subnets issue

[FortiKnight]

Hello everyone,

I am running a Fortigate with FortiOS v7.4.5, where the default VLAN traffic arrives untagged on the LAN interface. Currently, several networks (e.g., 10.0.1.0/24 and 10.0.2.0/24) are operating over this interface.

After assigning a secondary IP address to the interface (10.0.1.3/24), routing between the two subnets works as expected. However, the security policies configured between these networks are not being enforced.

I have reviewed some relevant articles, but the suggested solutions do not seem to resolve the issue. According to these Fortinet Technical Tips, the traffic should be blocked by default and then allowed through the appropriate policies:

• Allow traffic between different subnets with the same VLAN
• How to allow traffic when using the same logical interface

I have tested this in a lab environment, and as expected, the traffic between the subnets is routed, but the configured security policies are not being applied.

Is this behavior expected? Are there any alternatives, or is there something missing in the configuration?

Thank you in advance for your help.

[AEK]

Hi

Try with a software switch with explicit intra switch policy.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Software-switch-policy/ta-p/198381

Another method that "should" work is to put the interface in a zone with denied intra zone traffic, the create a policy to allow the required traffic.

[zeucqu2]

Yes even if they are on the same VLAN ID, the systems don't know about anything outside of their configured subnet and will send all other traffic to the default gateway. The only difference is that they are all in the same broadcast domain. I won't rant about the ridiculousness of this because I'm sure you are already aware.

[FortiKnight]

Thanks for your reply.

I configured the software switch in explicit mode, but routing between networks is blocked, and even after allowing traffic, the rules aren't applied. When using zones, traffic flows, but deny rules still don't work, just like before.

Is the only solution to move each network to a different interface or segment them into VLANs?

Also, what’s the purpose of those technical tips if they don’t seem to apply here? I'd like to understand that.

[ebilcari]

You can read more about firewall policies on same interface in this article. This is not recommended and can be used temporarily usually during a migration phase.

Using VLANs under the physicals interface (sub-interface) when a switch connects is the quickest way to isolate the hosts in L2 and easy apply in firewall policy as a dedicated interface:

[FortiKnight]

Hello,

thank you for your reply. Unfortunately, this solution hasn’t resolved the issue either. When I try to modify rule 0, instead of updating it, a new rule is added with an ID different from 0, and the situation remains unchanged. The routing works correctly, but when I try to block traffic between one IP and another, or between different subnets, it doesn’t work. I’ve run several tests in the test environment, but the problem persists in every scenario.

[ebilcari]

You are still going if the configuration that includes a single interface with the secondary IP right?

The rule 0 is just used for CLI configuration without risking to overwrite an existing rule. Try to order the newly created policy in the top and make sure that the hosts are using the FGT as their default gateway and not some other network device in the network. You can do a simple packet capture to that interface to verify that this traffic is indeed going through FGT.

[FortiKnight · Accepted solution]

TAC has found the solution to the problem:
Traffic handled by FortiGate for packet w... - Fortinet Community

Thank you everyone.