Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
dbrady
New Contributor

Routing Issue between Fortigate 100E and Cisco 3650

Hey guys,

 

I'm hoping someone can help me. I have recently replaced unmagged switches with a Cisco 3650 switch and setup inter-vlan routing. I have created 4 vlans to segregate the network (vlan10 management, vlan20 servers, vlan30 end user device, vlan40 WiFi AP).

 

I have connected the fortigate (v5.4.5,build6225) to the switch (trunk port) and created the vlans on the fortigate interface connected to the switch. I have setup a default route on the switch to point traffic to the FW (IP in vlan10). the switch can ping all vlan interfaces on the FW but an end user device can't ping the FW. A work around to was enable Asymmetric routing but I understand this to be a test not a workaround.

 

As all traffic from the switch is going over vlan10 I have created the neccesary ipv4 policys to allow this traffic.

 

Can anyone shed some light where I am going wrong please? Attached is the topology.

 

14 REPLIES 14
dbrady

ede_pfau wrote:

yep, but halfways only...where are the VLANs on the switch? Why don't you declare the switchport which connects to the FGT as a VLAN trunk and run all 4 VLANs over it?

That's how it was setup originally but i had reverse path check issues. So asymmetric routing was enabled as a work around.

Anurag_Goyal

As did in FGT 300C & cisco3650, I didn't use any extra routing.  I made ipv4 policies to allow access the users to another vlans.

It is working since 3 years.

Anurag Goyal

Anurag Goyal
dbrady

anurag wrote:

As did in FGT 300C & cisco3650, I didn't use any extra routing.  I made ipv4 policies to allow access the users to another vlans.

It is working since 3 years.

Can you see any issues with the way I setup mine? I have 1 ipv4 policy instead of multiple if I have the VLANs configured on the FGT.

pyy
New Contributor III

which is the default gateway for the devices L3 Switch or FG? if L3 then why you have subif on the FG If just create policies for the intervlan communication or a zone

Anurag_Goyal

Default gatway for L3 is FG, and yes it for inter vlan communication.

Anurag Goyal

Anurag Goyal
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors