Software switch with VLAN sub interfaces = no go !?

[#1]

Evening all, have logged this with Fortinet support but thought i would try the neighborly approach as well ;) Setup: - Two ports configured as a software switch, this switch has no IP assigned and no management access of any kind. - A VLAN subinterface was created on the software switch, this was assigned an IP and management access as well as ping. - An ESX test server connected to each switch port (trunk) with suitably tagged test VM in place. - Firewall NAT policy in place to allow hosts on the VLAN out to the internet. Issue: The two VM test servers are able to talk to each other across the firewall' s two switch ports via the VLAN subinterface. No problem here, they can ping the gateway address also no prob. They can also ping out to the internet as expected. The issue is the hosts are NOT able to actually load a web page from the itnernet, or even the local network (outside of the VLAN), browsers just sit there waiting for the return data after DNS lookups are done. This is strange becuase: - The same test VM servers can access the internet perfectly when the subinterface is on one physical port and not a soft switch. - The same test VM servers can access the internet perfectly when connected to a soft switch directly (no VLAN subinterface) - All of the expected routes are shown in the route monitor and pings to the internet work flawlessly as do DNS lookups. - I can telnet from a test server to a web server on port 80 no problem. So there seems to be either some configuration step I have missed that is required for using VLAN subinterfaces AND soft switches together ... or a bug ? or something else ... ?

[#2]

Morning all ... Fortinet support say that you should do the following: - Set mtu-override enable on the soft switch via CLI - Set mtu value on the soft switch via CLI - Set mtu-override on the VLAN sub interface Have tried this just now (with a reboot) with no luck so have reported this back to them. I' m going to rebuild the switch once more and set the MTU values on the physical ports, there must be some combination that works !!

[#3]

Still no joy getting this to work, have rebuilt the switch with the physical port MTU' s set beforehand and still nothing, then went and changed the mtu-override and set value for the soft switch as well as mtu-override for the VLAN and yet still no http traffic. No response from Fortinet over night also ... its starting to feel pretty lonely :p

[Carl_Wallmark]

did you try the new Patch 2 ?

[#5]

Have downloaded and installed just now (thanks for the reminder !) and will test it out today ... can' t see anything in the release notes so not holding out much hope for it.

[#6]

I can confirm there is no change with patch 2

[Carl_Wallmark]

but it did work when you lowered the MTU value ?

[#8]

When the server NIC MTU is lowered everything is fine yes, it' s not really a great permanent system wide fix though.

[Carl_Wallmark]

and fortinet doesnt agree that it is a bug ?

[#10]

I' ve not received any response from them since the 25th !! Not very impressive, i' ll post another followup message to them now and see if anyone is home.

[FortiRack_Eric]

Why would one use a software switch on a FG unit? Especially in combination with VLAN' s. Even if it would work (which a doubt with VLANs) all traffic would go through CPU!!! Thus seriously degrading performance. What kind of FG are you using? Furthermore if you lower MTU on FG then the nic connected to the FG must have matching MTU