Transit vlan

[______mih_ai______]

Hello.

sorry for my bad english.

I have fortigate 200d and i need set up transit vlan

I move virtual server from my network to provider, and he can't give me l2 network, only trasnit l3

Now i need set up transit vlan where i route my vlan, and i don't understand how i must create it.

Cable from provider plug in physical interface on fortigate, i set ip of transit vlan on it and create vlan with tag.

see attach

[Toshi_Esumi]

The diagram tell a thousand words. Very simple. Create a vlan interface with vlanid 901 under the physical interface then put 10.3.198.10/24 on the vlan interface. You obviously need proper static routes to reach those 5 subnets.

[______mih_ai______]

When i create vlan 901 under physical interface, i can't ping provider gate 10.3.198.1. When i try set up gate for static route i write 10.3.198.10 and it's fail, i can't use ip address which choosen for ip adress on physical interface. My provider tell me use 10.3.198.10 like gate for me

[Toshi_Esumi]

Leave IP area blank on the physical/parent interface. That's a non-tagged interface. Then you should sniff traffic on the vlan 901 interface (diag sniffer packet VLAN_INTERFACE_NAME) to get any clue for what's going on.

[sw2090]

that is correct so far because you already have an interface in that network. Just the ip must not be on the physical interface but on the vlan 901 interface!

As you have an Interface in that Network you don't need a static route because the interface already knows the routing for that subnet.

What you have to have - like said some posting above - is static routes for the 10.3.10x.0/29 subnets. And these have to have the vlan interface as interface and 10.3.198.10 as Gateway.

Additionally you still will have to set up policies to allow traffic from mynetowrks to 10.3.10x.0/29.

[______mih_ai______]

I ask provider which type of port he use, it was access, he change type of port to trunk.

I create interface under physical and now i can ping him gate 10.3.198.1

But static route doesn't work.

I exec "diag sniffer packet" 

see attach all in one.

[sw2090]

as I said: you dont need a static route for 10.3.198.0/24 since there is an interface in that subnet on your FortiGate. 

You do need static routes for 10.3.100.0/29, 10.3.101.0/29,10.3.102.0/29,10.3.107.0/29 and 10.3.110.0/29 with 10.3.198.1 as Gateway and the vlan 901 interface as interface.

And then you need Policies to allow traffic from your networks via your FGT and the transit vlan to those subnets mentioned above.

[______mih_ai______]

yes it's my fall that i use wrong gate, now i set 10.3.198.1

I found problem in routing:

Routing entry for 10.3.107.0/29   Known via "static", distance 10, metric 0     10.3.198.1, via transit vlan Routing entry for 10.3.107.0/29  Known via "connected", distance 0, metric 0, best   * is directly connected, VLAN107

How i can change best routing for vlan107?

I try change distance and set priority, but it doesn't work.

I don't use route-map

[sw2090]

hmm...what is the Interface "connected"?

Do you have a misconfigured interface?

Alas you could change die Priority/Distance of your route but you cannot influnence routes that come automagically like net routes over physical or vlan interfaces....

You must not have configured any interface for 10.3.107.0/29 on your FGT. You should only have a static route and at least one policy to allow the traffic.

[______mih_ai______]

Hello

I create vlan under physical interface see attach in post 6.

Before i don't understand how create traffic policy rules without interface for 10.3.107.0

But now I understand how I should have been created interface and rules.

If port access on provider side set on physical adapter set ip 10.3.198.10, if trunk to under physical adapter create vlan 901 with ip 10.3.198.10

create static route for 10.3.107.0 with gate 10.3.198.1

create Address for 10.3.107.0/29

Create ip4v policy from provider to lan1: 

Incoming Interface  transit vlan 

Outgoing Interface lan1

Source 10.3.107.0 

Destination all

Thanks all