Routing between two different subnet on internal

[metis]

Hello everybody. I' ve a Fortigate 100A with two IP on the internal interface. The primary IP is 192.168.1.1/24 and secondary is 10.10.0.1/16, I want to route the network traffic between the two different subnets. I' ve tried with 2 internal -> internal rules: the first permits traffic from 192.168.1.0/24 to 10.10.0.0/16 and the second permits traffic from 10.10.0.0/16 to 192.168.1.0/24 but if I don' t active NAT in each rule the routing doesn' t work. There' s a better way to obtain visibility between two different subnet on the same interface? Many Thx!

[#2]

Hi! Actually it' s one possible way to obtain ' visibility' . As you already mentioned, you need some kind of _routing_ between your subnets. This can be done either on one Interface or connect each subnet to a unque interface of your FG. (and: don' t care about the nameing of the ports. Keep in mind that they are only names...) Actually you should be able to disable NAT on both polycies in case _all_ devices in both networks know how to reach the oposite Network. This is usually done by modifying the default gateway to 192.68.1.1 or 10.10.0.1 If it still does not work: Have you turned on any personal Firewall on the PC' s? (e.g. M$ Windows Firewall assumes by default that sessions from other subnets than it' s own are *evil*. In my personal opinion Microsoft Windows Firewall is *evil*. ;)

[metis]

Hi woswasi , all the devices in both subnets have the correct default gateway but if I turn off NAT the routing doesn' t work. There isn' t any personal firewall on the clients, the O.S. on the client are different: MS Windows, Linux, Solaris but the behavior is the same. Do you think that maybe I need to set a specific routing policy on the fortigate in the " Router" section to eliminate NAT between the subnets? At this moment the only setting in " Router " section is the default gateway to the public HDSL router on Wan1. T.I.A.

[#4]

Hi! actually all routing entries on your FG seems to be correct (otherwise the version with NAT would not work). Additionally you don' t need to define any routing policy for directly connected interfaces on the FG. hmmm Do you use VLANs? By the way: how did you define 2 IP' s on a single network interface? Via the CLI via ' secondaryip' ? Just to come around your Problem and even for performance reasons, try to bind just one network on one interface. e.g. configure just 192.168.1.1/24 on the internal interface and 10.10.0.1/16 on the dmz2 interface. Delete all other policies dealing with both subnets. Remove all secondary IP' s on those interfaces. Define new policies for traffic from internal/192.168.1.0/24 to dmz2/10.10.0.0/24 and the other way around. Connect _both_ interfaces (dmz2 and internal) to your local subnet (even when ist' s on the same switch using no vlans). In case you already used the dmz2 interface, just take any other spare interface.

[metis]

Hi woswasi

Do you use VLANs?

No. I don' t.

By the way: how did you define 2 IP' s on a single network interface? Via the CLI via ' secondaryip' ?

Yes, I used the CLI via ' secondaryip'

Just to come around your Problem and even for performance reasons, try to bind just one network on one interface.

Unfortunaly all fortigate' s interfaces are in use. Other Ideas? Many thanks for your help!