Software switch with VLAN sub interfaces = no go !?

[#1]

Evening all, have logged this with Fortinet support but thought i would try the neighborly approach as well ;) Setup: - Two ports configured as a software switch, this switch has no IP assigned and no management access of any kind. - A VLAN subinterface was created on the software switch, this was assigned an IP and management access as well as ping. - An ESX test server connected to each switch port (trunk) with suitably tagged test VM in place. - Firewall NAT policy in place to allow hosts on the VLAN out to the internet. Issue: The two VM test servers are able to talk to each other across the firewall' s two switch ports via the VLAN subinterface. No problem here, they can ping the gateway address also no prob. They can also ping out to the internet as expected. The issue is the hosts are NOT able to actually load a web page from the itnernet, or even the local network (outside of the VLAN), browsers just sit there waiting for the return data after DNS lookups are done. This is strange becuase: - The same test VM servers can access the internet perfectly when the subinterface is on one physical port and not a soft switch. - The same test VM servers can access the internet perfectly when connected to a soft switch directly (no VLAN subinterface) - All of the expected routes are shown in the route monitor and pings to the internet work flawlessly as do DNS lookups. - I can telnet from a test server to a web server on port 80 no problem. So there seems to be either some configuration step I have missed that is required for using VLAN subinterfaces AND soft switches together ... or a bug ? or something else ... ?

[ede_pfau]

Interesting aspect. When using " type=switch" on an interface I never thought of NPU usage before. Havent' t used this feature often but only for " renaming" ports: instead of " port13(wan1)" -> " port12(internal)" in the policy list, it would read " wan1->internal" which is way clearer. In all I know of 3 ways to change the port name: - alias - zone - switch (with only 1 member) The alias feature is half-baked as cited above - the alias does not replace the port name but is appended only. Ugly and error prone. Zone and switch definition (in this respect only) are the same to me - would you think in terms of performance that a zone def would be less detrimental to performance than the switch def? (I can imagine that looking at this usage from the perspective of performance and NPU usage could make you feel bad for the rest of the day...but it' s creative usage at least).

[ede_pfau]

...the 200B has no issue with 5 Mbps via CPU at all...

[#4]

I' ll create a quick diagram in the morning to illustrate why the switch and VLAN combination is desired, essentially its to control traffic flow between two WAN end points of the same subnet (one side local to the firewall and one geographically remote). I had not considered CPU utilisation for this setup, the circuit is 5MBit.