Software switch with VLAN sub interfaces = no go !?

[#1]

Evening all, have logged this with Fortinet support but thought i would try the neighborly approach as well ;) Setup: - Two ports configured as a software switch, this switch has no IP assigned and no management access of any kind. - A VLAN subinterface was created on the software switch, this was assigned an IP and management access as well as ping. - An ESX test server connected to each switch port (trunk) with suitably tagged test VM in place. - Firewall NAT policy in place to allow hosts on the VLAN out to the internet. Issue: The two VM test servers are able to talk to each other across the firewall' s two switch ports via the VLAN subinterface. No problem here, they can ping the gateway address also no prob. They can also ping out to the internet as expected. The issue is the hosts are NOT able to actually load a web page from the itnernet, or even the local network (outside of the VLAN), browsers just sit there waiting for the return data after DNS lookups are done. This is strange becuase: - The same test VM servers can access the internet perfectly when the subinterface is on one physical port and not a soft switch. - The same test VM servers can access the internet perfectly when connected to a soft switch directly (no VLAN subinterface) - All of the expected routes are shown in the route monitor and pings to the internet work flawlessly as do DNS lookups. - I can telnet from a test server to a web server on port 80 no problem. So there seems to be either some configuration step I have missed that is required for using VLAN subinterfaces AND soft switches together ... or a bug ? or something else ... ?

[Carl_Wallmark]

Hi, what firmware are you using ? i had these problems with early 4.0 MR1, and also with 4.0,

[#3]

Am running the latest 4.0 MR2 Patch 1 (build 0279,100519), forgot to mention its on a Fortigate 200B. Given you ' had' these problems, was it fixed in a subsequent release and identified as a bug ?

[Carl_Wallmark]

yes, they were all fixed with a patch, are your sure you have all the firewall policys you need ?

[#5]

Pretty sure, essentially the rules were the same as for the straight software switch and VLAN sub (without soft switch) ... interestingly ping to the internet works flawlessly as does telnet to a web server on port 80. Source Int: VLAN 73 (this is the vlan subinterface on the soft switch) Source Address: Subnet 73 (private address range servers sit on) Destination Int: port1 (internet connected port, default route is in place) Destination Address: all Schedule: always Service: ANY Action: ACCEPT NAT: Enable NAT

[Carl_Wallmark]

it sounds like one of the bugs i had, test this: lower the MTU value on the VLAN interface, if thats not working, wait until tomorrow, appearantly patch 2 for MR2 will be out...

[#7]

Well this is all getting a bit interesting, you were right on the money Selective !! I lowered the MTU on the test servers and all is now working as it should be, however there is no option to change MTU (that i can see) for either the software switch or the VLAN subinterface. Maybe these need to be set on the ports before the soft switch is created ? I discovered that if the ports are administratively down before making the soft switch, they remain down after and there is no way to bring them up !! Maybe its the same.

[ede_pfau]

in the Web GUI, System / Network / your_interface, just above the admin access settings: " Override MTU value" , tick and set it. As I don' t have enough unused ports on my FG I can' t test it on a softswitch port, though. If the option is missing then I' d bet you' d have to set it on both physical ports beforehand.

[Citylight]

Hi Ede, yes it is that way. There is no option at the GUI but the CLI lets you change the MTU without any warnings. But it won' t work. It is important to change the MTU before building the soft switch. Citylight

[Carl_Wallmark]

nice to hear it worked, but it must be a bug ! can you test to change MTU before making a soft-switch ?