Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
jadeltoro
New Contributor III

Routing internal interfaces between 2 subnets

Hello good morning.
Please, I wanted to ask the following question.
I have a router connected to port 5 on my Fortigate in the following IP range: 192.168.30.100/24.
On the other hand, I have on port 3 (configured as an interface) an output to a switch in the range 192.168.1.0/24.
I am trying to communicate each subnet with the other by establishing a firewall policy that has port 3 as output and port 5 as input, but I cannot access it.
What am I doing wrong?
Thank you.
1 Solution
jadeltoro
New Contributor III

Hi,
I'm sorry for the delay and inconvenience caused.
In the end, everything was configured correctly, the only thing left to do was configure the 192.168.30.100 gateway on the side of ports 3 and 5.
Thank you all for your collaboration. A cordial greeting.

View solution in original post

19 REPLIES 19
srajeswaran
Staff
Staff

1. Can both subnet device atleast ping the Fortigate interface IPs?
2. Check the ARP table on Fortigate "get system arp" and see if the destination IPs are learned

If the above 2 are working, we need to re-evaluate the policy config else there is something else outside Firewall config.

Regards,

Suraj

- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

jadeltoro

Hello, thank you for your quick response.
I cannot ping, neither from the 192.168.1.0 network to the computers on the 192.168.30.100 network, nor the other way around.
In the ARP table, it only shows the gateway IP address of the router connected to port5: 192.168.30.101 0 "mac" port5.
There are more devices connected, at other addresses on the same subnet: 192.168.30.x, but they do not appear in the ARP table.

Toshi_Esumi
Esteemed Contributor III

@srajeswaranis asking you to ping from the FGT in CLI to the connected device, then check the ARP table. If you still don't see the device you pinged in the table, there is a L2 connection problem over the switch(es).

 

Toshi

srajeswaran


Below given is what I understood from the shared data,
192.168.1.0/24----Switch-----(port3)Fortigate(port5)--------Router(192.168.30.101)

You have mentioned , there are more devices on 192.168.30.x subnet, how are they connected? Is there a switch between Fortigate and Router?
Is the switches operate in L2 mode ?

Can you share a topology diagram with the devices/address.

Regards,

Suraj

- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

jadeltoro

Excuse me for my limited knowledge in the use of Fortigate, as well as in the design of the diagram with the topology.
I hope the following drawing can answer the questions:

Topologia_Camaras.JPG

srajeswaran

Can you share the port3 and port5 configuration from Fortigate.

show system interface port3
show system interface port5

 

Regards,

Suraj

- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

jadeltoro

config system interface
edit "port3"
set vdom "root"
set ip 192.168.1.160 255.255.255.0
set allowaccess ping https ssh snmp fgfm radius-acct fabric ftm
set type physical
set alias "INTERFAZ OFICINA"
set device-identification enable
set role lan
set snmp-index 9
next
end

 

config system interface
edit "port5"
set vdom "root"
set ip 192.168.30.100 255.255.255.0
set allowaccess ping https http fabric
set type physical
set device-identification enable
set lldp-transmission enable
set role lan
set snmp-index 11
next
end

smaruvala

Hi,

 

- Can you please let us know if you are able to ping from port5 to the destination?
- When you are trying to ping from the source to the destination do you see the logs in the traffic logs of the Firewall?
- Have you tried to check the sniffer/packet capture on the firewall when performing the testing?
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Packet-capture-sniffer/ta-p/198313
- Is the upstream a router or a layer2 device? Because from the diagram it looks the router is not splitting the broadcast domain.

 

Regards,

Shiva

thoufik786
New Contributor II

Hi @jadeltoro,

 

Please share the output of the below commands from FGT.

 

execute ping-options source 192.168.30.100  

execute ping 192.168.1.160

execute ping 192.168.30.101

 

execute ping-options source 192.168.1.160   

execute ping 192.168.30.100

execute ping 192.168.1.2

 

Regards,

Thoufik.

Thoufik
Thoufik
Labels
Top Kudoed Authors