Routing over Aggregate Interface not working

[Danté]

Hi,

I need some assistance in setting up routing between interfaces and subnets.

We have two ports that are members of aggregate interface that is connected to a cisco switch where LACP (LAG) is enabled and vlan tags were added to the trunk on the cisco cli.

Clients get dhcp and also the wireless VLANS are working and packets are tagged.

What I can't get to work is routing between the main native subnet on the aggregate and the vlan subnets also on the aggregate. I have tried both way policies, and a combination of policy routes and ipv4 policies. I created then another physical interface on the FortiGate and set up ipv4 policy from the native subnet to the new interface on a different subnet and I had access to that subnet. 

There are also another subnet in our internal network behind a router that I can't access. Please advise if there are issues with Aggregate interface routing and if I should rather have a normal interface?

Thanks

[Toshi_Esumi · Accepted solution]

Sounds like the LAG is working fine.

Those vlans and it's parent interface (non-tagged) can talk each other by policies without needing anything else. Those are directly connected interfaces. When it works, and when you sniff the traffic with "diag sniffer packet any 'host x.x.x.x' whilese sending packets from or to x.x.x.x, you would see they're coming in from on interface and going out to another interface. If it's not working, likely you would see they come in but either not going out or going out to a wrong interface, which i unlikely if it's directly connected.

If they're dropped - coming in but not goiong out - that's when you need to use "flow debugging" or "diag debug flow" to see why they're dropped.

For routing to a subnet behind a router, involves a routing because it's not directly connected. Just like any routers, you have to have a route toward the interface that delivers packets to the router. Then your policy from the incoming interface to the interface toward the router needs to allow the combination of source and destination IPs.

[Danté]

Hi,

Thank you for your reply,

I ended up finding the root cause of the problem on my own NIC which had a secondary IP that for some reason caused the routing not to work on my own PC. It is working perfectly as you explained.