Standalone FortiSwitch default route

[cbecker]

A Standalone FortiSwitch configured with 3 VLANs and the interfaces to match.

Devices on the VLANs can ping each other but they cannot ping anything that must use the default route, stuff outside the 3rd party firewall.

If I add a static route to 8.8.8.8 I can ping it.

Any ideas why the default route isn't working?

config switch vlan
edit 1
set description "Data"
next
edit 2
set description "Door-Access"
next
edit 3
set description "IN-Printers"
next

edit "Doors"
set ip 192.168.2.254 255.255.255.0
set allowaccess ping https ssh
set snmp-index 60
set vlanid 52
set interface "internal"
next
edit "Printers"
set ip 192.168.3.254 255.255.255.0
set allowaccess ping https ssh
set snmp-index 61
set vlanid 54
set interface "internal"
next
edit "Data"
set ip 192.168.1.254 255.255.255.0
set allowaccess ping https ssh
set snmp-index 63
set vlanid 50
set interface "internal"
next

config router static
edit 1
set dst 0.0.0.0 0.0.0.0
set gateway 192.168.1.50
next

[Toshi_Esumi]

Do you have an interface with 192.168.150.x/24 configured under "config system interface"?
Without it, it can't reach the gateway 192.168.150.50.
Or, if what I'm suspecting is correct, you actually don't have the default route in the routing table.
Try "get router info routing-table all". If the interface for the default gateway exists, it would show like below:

S224DFTFxxxxxxxx # get router info routing-t all
Codes: K - kernel route, C - connected, S - static, R - RIP,
            O - OSPF, I - IS-IS, T - Table, F - PBR,
            > - selected route, * - FIB route, q - queued, r - rejected, b - backup, ^ - HW install failed
            t  - trapped, o - offload failure

VRF default:
S>* 0.0.0.0/0 [10/0] via 10.x.x.1, mgmtXXX, weight 1, 00:00:05
<snip>

I'm suspecting it's not there in your FSW.

Toshi

[cbecker]

Toshi,

My mistake the gateway in the default route should have been 192.168.1.50 in the original post.

I have also verified that the route is in the routing-table.

get router info routing-table all
Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, T - Table,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup, ^ - HW install failed
t - trapped, o - offload failure

VRF default:
S>* 0.0.0.0/0 [10/0] via 192.168.1.50, Data, weight 1, 00:01:18
C>* 192.168.52.0/24 is directly connected, Door, 00:01:20
C>* 192.168.54.0/24 is directly connected, Printers, 00:01:20
C>* 192.168.1.0/24 is directly connected, Data, 00:01:20

The switch can ping 8.8.8.8 but not the clients connected to the switch.

execute ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=0 ttl=116 time=12.1 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=116 time=10.1 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=116 time=11.0 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=116 time=9.8 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=116 time=11.1 ms

--- 8.8.8.8 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 9.8/10.8/12.1 ms

The switch is running 7.2.8

[Toshi_Esumi]

I would assume all devices in VLAN 50 (192.168.1.0/24) can get through the gateway device (with IP:192.168.1.50) since the gateway is in the same subnet.
Then the next thing I would check is if the gateway device has routes for 192.168.2.0/24 and 192.168.3.0/24 to 192.168.1.254. Likely static routes.

Toshi