Routing Problem with 2 LAN Networks

[RolandBaumgaertner72]

Hi,

we have a new FG90G and we want to add another LAN segment to separate the IT dept. So the problem is that I have LAN OLD 10.10.111.0/24 (port1) and LAN IT 10.10.112.0/24 (port3). 

Our MPLS network is 10.10.0.0/16 with a route to the MPLS router 10.10.11.1.

So my host 10.10.112.135 cant ping 10.10.111.200 though I have a policy from LAN IT > LAN ALL and ANY. Sniffing I see that the FG routes the traffic pinging 10.10.111.200 to the MPLS network since 10.10.0.0/16 gets routed over the MPLS network.

So I tried a Policy Route to avoid problems from LAN IT to LAN outgoing interface LAN IT and I tried different options in this Policy Route but I never see that traffic from LAN IT goes to LAN.

Both LANs are Sowftware Switch. What am I missing?

Thanks!

[AEK]

Is the network 10.10.111.0/24 directly connected to the FGT (port1 IP is 10.10.111.x) or is it behind another router?

If is directly connected then you find in your routing table that the route in directly connected (through port1) and it will have automatically the lowest priority (mean highest).

[RolandBaumgaertner72]

Both 10.10.111.0/24 and 10.10.112.0/24 are connected directly to the same switch. 

# get router info routing-table all

C 10.10.111.0/24 is directly connected, LAN 
C 10.10.112.0/24 is directly connected, LAN IT

I am lost, I dont get it, I dont see anything comming from 112 to 111, sniffing with my IP I get

88.694780 port3 in 10.10.112.135.64885 -> 10.10.111.245.443: udp 1220
88.694782 LAN IT in 10.10.112.135.64885 -> 10.10.111.245.443: udp 1220

Routing is not working, I cant get it from LAN IT Interface to LAN.

Any suggestions?

[AEK]

The output doesn't show it is sent through the MPLS interface.

You can run the following to see which route it selects.

diag debug flow filter addr x.x.x.x
diag debug flow filter proto 1
diag debug flow show iprope enable
diag debug flow show function-name enable
diag debug flow trace start 100
diag debug enable

Then start a fresh ping command to catch it from the beginning. 

[RolandBaumgaertner72]

I left the office already but I did some sniffing and without policy Route the packages were sent out via X1 or the MPLS interface.

Than I tried with different configurations with the policy route (I am never quite sure if I have to put the interface gateway or without) but when I configured source interface my LAN IT with LAN IT address and destination LAN and LAN address (I think I tried with and without outgoing interface with gateway IP and also I tried from outgoing interface LAN IT and LAN) and than I saw that the sniffing Port3 and LAN IT but never passed to the LAN interface.

Can t believe that it is so difficult when you have 2 LANs connected directly and I cant have access from one LAN to the other.

One thing, we dont have VLans in the Switch and both LANs are connected equaly in the Switch.

Any idea?

[Toshi_Esumi]

You sound strangely. If they're not VLANs how you configured those on top of port3 or port1? Please share us,
config sys int
   edit "LAN"
   show
   next
   edit "LAN IT"
    show
end

And are you saying both /24 subnets are on the same default VLAN/broadcast domain of the switch without any switch port group separation? It's just a L2 switch, right?  

Toshi

[AEK]

When you have directly connected networks you don't need policy route to force it since the connected have the highest priority.

I suspect the firewall policy may be wrong. Can you share it?

[RolandBaumgaertner72]

edit "LAN IT"
set vdom "root"
set ip 10.10.112.2 255.255.255.0
set allowaccess ping https snmp http
set type switch
set alias "LAN IT"
set device-identification enable
set lldp-transmission enable
set role lan
set snmp-index 16
set ip-managed-by-fortiipam disable
next
edit "LAN Maza"
set vdom "root"
set ip 10.10.111.2 255.255.255.0
set allowaccess ping https snmp http
set type switch
set alias "LAN Ma"
set device-identification enable
set lldp-transmission enable
set role lan
set snmp-index 15
set ip-managed-by-fortiipam disable
next

Routing I shared allreay.

Policies:

config firewall policy
edit 96
set name "Sistemas > LAN Ma"
set uuid dccae670-5b18-51f0-f5c6-26827b97da28
set srcintf "LAN Sistemas"
set dstintf "LAN Ma"
set action accept
set srcaddr "111MZ - Rango 112.128-165 IT"
set dstaddr "111MZ - Subnet 111.0/24"
set schedule "always"
set service "ALL"
set utm-status enable
set ssl-ssh-profile "certificate-inspection"
set av-profile "default"
set logtraffic all
set nat enable
set port-preserve disable
next
end

config firewall policy
edit 118
set name "LAN Ma > LAN Sistemas"
set uuid e2882fd8-8efc-51f0-1dcc-8f5097359b97
set srcintf "LAN Maza"
set dstintf "LAN Sistemas"
set action accept
set srcaddr "LAN-Maza"
set dstaddr "LAN-Sistemas"
set schedule "always"
set service "ALL"
set nat enable
next
end

I just dont get it

[AEK]

Here I see the defined interfaces are not the same as the ones used in the policy. I think it should be LAN IT instead of LAN Sistemas in the policy.

[Toshi_Esumi]

@AEK answered your original question.

I didn't know 90G has all those ports in a software-switch ("type: switch"). Then you must have separated those ports from the default one whatever the name is.
If you're very keen interface performance, I would remove those ports from the soft-switches and use port1 and port3. As your sniffing is indicating it's taking two steps (hitting port3 first then LAN IT next). You can't use more descriptive names you want in the policies though. 


Toshi