Routing internal interfaces between 2 subnets

[jadeltoro]

Hello good morning.
Please, I wanted to ask the following question.
I have a router connected to port 5 on my Fortigate in the following IP range: 192.168.30.100/24.
On the other hand, I have on port 3 (configured as an interface) an output to a switch in the range 192.168.1.0/24.
I am trying to communicate each subnet with the other by establishing a firewall policy that has port 3 as output and port 5 as input, but I cannot access it.
What am I doing wrong?
Thank you.

[srajeswaran]

1. Can both subnet device atleast ping the Fortigate interface IPs?
2. Check the ARP table on Fortigate "get system arp" and see if the destination IPs are learned

If the above 2 are working, we need to re-evaluate the policy config else there is something else outside Firewall config.

[jadeltoro]

Hello, thank you for your quick response.
I cannot ping, neither from the 192.168.1.0 network to the computers on the 192.168.30.100 network, nor the other way around.
In the ARP table, it only shows the gateway IP address of the router connected to port5: 192.168.30.101 0 "mac" port5.
There are more devices connected, at other addresses on the same subnet: 192.168.30.x, but they do not appear in the ARP table.

[Toshi_Esumi]

@srajeswaranis asking you to ping from the FGT in CLI to the connected device, then check the ARP table. If you still don't see the device you pinged in the table, there is a L2 connection problem over the switch(es).

Toshi

[srajeswaran]

Below given is what I understood from the shared data,
192.168.1.0/24----Switch-----(port3)Fortigate(port5)--------Router(192.168.30.101)

You have mentioned , there are more devices on 192.168.30.x subnet, how are they connected? Is there a switch between Fortigate and Router?
Is the switches operate in L2 mode ?

Can you share a topology diagram with the devices/address.

[jadeltoro]

Excuse me for my limited knowledge in the use of Fortigate, as well as in the design of the diagram with the topology.
I hope the following drawing can answer the questions:

[srajeswaran]

Can you share the port3 and port5 configuration from Fortigate.

show system interface port3
show system interface port5

[jadeltoro]

config system interface
edit "port3"
set vdom "root"
set ip 192.168.1.160 255.255.255.0
set allowaccess ping https ssh snmp fgfm radius-acct fabric ftm
set type physical
set alias "INTERFAZ OFICINA"
set device-identification enable
set role lan
set snmp-index 9
next
end

config system interface
edit "port5"
set vdom "root"
set ip 192.168.30.100 255.255.255.0
set allowaccess ping https http fabric
set type physical
set device-identification enable
set lldp-transmission enable
set role lan
set snmp-index 11
next
end

[smaruvala]

Hi,

- Can you please let us know if you are able to ping from port5 to the destination?
- When you are trying to ping from the source to the destination do you see the logs in the traffic logs of the Firewall?
- Have you tried to check the sniffer/packet capture on the firewall when performing the testing?
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Packet-capture-sniffer/ta-p/198313
- Is the upstream a router or a layer2 device? Because from the diagram it looks the router is not splitting the broadcast domain.

Regards,

Shiva

[thoufik786]

Hi @jadeltoro,

Please share the output of the below commands from FGT.

execute ping-options source 192.168.30.100  

execute ping 192.168.1.160

execute ping 192.168.30.101

execute ping-options source 192.168.1.160   

execute ping 192.168.30.100

execute ping 192.168.1.2

Regards,

Thoufik.