Routing Problem with 2 LAN Networks

[RolandBaumgaertner72]

Hi,

we have a new FG90G and we want to add another LAN segment to separate the IT dept. So the problem is that I have LAN OLD 10.10.111.0/24 (port1) and LAN IT 10.10.112.0/24 (port3). 

Our MPLS network is 10.10.0.0/16 with a route to the MPLS router 10.10.11.1.

So my host 10.10.112.135 cant ping 10.10.111.200 though I have a policy from LAN IT > LAN ALL and ANY. Sniffing I see that the FG routes the traffic pinging 10.10.111.200 to the MPLS network since 10.10.0.0/16 gets routed over the MPLS network.

So I tried a Policy Route to avoid problems from LAN IT to LAN outgoing interface LAN IT and I tried different options in this Policy Route but I never see that traffic from LAN IT goes to LAN.

Both LANs are Sowftware Switch. What am I missing?

Thanks!

[RolandBaumgaertner72]

Hi,

thanks for your input. 

I solved it, first I deleted the policies (I am 95% sure there were correct) and configured new Policies from LAN IT > LAN and vice versa with ALL to ALL und Service ALL. 

We started the pinging again and NO ping and I just see the LAN IT Interface

FG_XX_HA1 # diag sniffer packet any "host 10.10.112.146 and 10.10.111.245" 4
interfaces=[any]
filters=[host 10.10.112.146 and 10.10.111.245]
0.829984 port3 in 10.10.112.146 -> 10.10.111.245: icmp: echo request
0.829985 LAN IT in 10.10.112.146 -> 10.10.111.245: icmp: echo request

In FortiView Sessions or in this new Policy LAN IT > LAN I dont see anything from this ping to 128.1.111.245.

THAN I realized that we had the problem before, from Wifi Interface they could not reach the 128.1.111.245 either. It is the same, traffic from one interface to the other and we had to create a Policy Route from Incomming Interface Wifi to LAN and gateway LAN with Gateway Address 0.0.0.0 and than it worked.

Now I deleted my old Policy Route and just copied the Wifi one and replaced Wifi with LAN IT, so Incomming LAN IT to address LAN and Gateway LAN with 0.0.0.0 as Gateway and than it worked.

Now, I dont think we should need a policy Route from LAN IT to LAN or from Wifi to LAN, this is strange with this G Modell.

We had some 30Gs but with small configurations and that is our first G with bigger configuration and now when I before started with a E or F modell I would always use Hardware Switch as Interface mode and with this G I dont have the option. When I am not using Vlan I can only use Software Switch.

Thanks again!

[Toshi_Esumi]

I don't have any G-series so I can't confirm. But you should still be able to remove them from the software switch under:
     config system switch-interface

It generally have WiFi quarantine interfaces by default with E, F models like below. But you should see those your have there.

fg40f-utm (switch-interface) # show
config system switch-interface
edit "wqt.root"
  set vdom "root"
  set member "wqtn.14.xxxxx" "wqtn.17.xxxxx" "wqtn.33.xxxx"
  next
end

Once you delete it (you have to remove it at all places it was used first), you should be able configure an IP on port1 or port3.


Toshi