Static Routes on ForiGate 80F

[Tyler]

I'm just getting into the FortiGates and had a dumb question. I have a lab setup with the following:

FortiGate Internal IP: 192.168.1.99 (just using the default)

Internal Group (consists of all available LAN ports):

Port1: Wifi/Mesh AP (hosts get 192.168.68.0/24)

Port2: NAS (192.168.1.50)

The hosts on the Wifi can see each other (of course) and they can get out on to the Internet. They cannot communicate with the NAS. I've tried to create a policy that says anything trying to get the the NAS (and vice-versa) is allowed, with all protocols allowed. Still, I can't communicate with the NAS from a Wifi host.

Do I have to I break Port1 out of the Internal group so I can reference it independently and create a static route? Or should the FortiGate already be able to allow internal communications between two directly connected devices, assuming there's a firewall policy correctly configured? Before I overcomplicate it and break the Port1 out, I figured I'd ask here. Appreciated!

[jangelis]

Hello,

is it possible to share the output of this command:

diagnose ip address list

to better understand the topology?

Jakub

[Tyler]

Sure! I have obfuscated the public IP address on the WAN.

Lab-FW # diagnose ip address list
IP=173.xxx.xxx.xxx->173.xxx.xxx.xxx/255.255.240.0 index=5 devname=wan1
IP=127.0.0.1->127.0.0.1/255.0.0.0 index=18 devname=root
IP=169.254.1.1->169.254.1.1/255.255.255.0 index=20 devname=fortilink
IP=192.168.1.99->192.168.1.99/255.255.255.0 index=21 devname=internal
IP=127.0.0.1->127.0.0.1/255.0.0.0 index=22 devname=vsys_ha
IP=127.0.0.1->127.0.0.1/255.0.0.0 index=24 devname=vsys_fgfm

[jangelis]

o.k. I see that is basically the default.

However in this case, if the wifi users get IPs from 192.168.68.0/24, then this WiFi-AP must do the NAT and translate the traffic to 192.168.1.x, and this ingresses port1 on FortiGate, correct?

If this is so, then you should not need to configure anything on the FortiGate, as this traffic is handled only by FortiGate's internal switch.

I understand you mentioned that the communication doesn't work, but from the FortiGate perspective there is no configuration that would allow or block this kind of traffic.

You mentioned that you would remove one interface (possibly internal1) from the internal switch and have the WiFi clients connected there.

This would be my preferred approach, however still in the WiFi AP should be just AP (just bridging the traffic and not routing).

With this setup, you can actually filter/monitor traffic from WiFi to NAS.

[Tyler]

Yeah, actually the wifi mesh isn't configured as a bridge. I think it can, though, so I'll try that next. That sounds like it would be the best solution.

[fiesta]

Hi,

If your APs get 192.168.1.x IP then yes you need static route to 68.x, gateway should be APs IP. Or just enable NAT in the policy (vice-versa).