Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
______mih_ai______
New Contributor II

Transit vlan

Hello.

sorry for my bad english.

I have fortigate 200d and i need set up transit vlan

I move virtual server from my network to provider, and he can't give me l2 network, only trasnit l3

Now i need set up transit vlan where i route my vlan, and i don't understand how i must create it.

Cable from provider plug in physical interface on fortigate, i set ip of transit vlan on it and create vlan with tag.

see attach

 

 

1 Solution
sw2090

you have to have

 

- one vlan interface that has vid of the transit vlan and is usually bend to a physical interface. You already have that.

- a static route for the subnet you want to reach over the vlan ith your providers gateway as gateway.

- at least one policy to allow the traffic. This has the transit vlan interface as source interface and the remote subnet as destination. Incoming interface is the interface you are on and source is the subnet you come from.

-- 

"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

View solution in original post

-- "It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
13 REPLIES 13
Toshi_Esumi
SuperUser
SuperUser

The diagram tell a thousand words. Very simple. Create a vlan interface with vlanid 901 under the physical interface then put 10.3.198.10/24 on the vlan interface. You obviously need proper static routes to reach those 5 subnets.

______mih_ai______

When i create vlan 901 under physical interface, i can't ping provider gate 10.3.198.1. When i try set up gate for static route i write 10.3.198.10 and it's fail, i can't use ip address which choosen for ip adress on physical interface. My provider tell me use 10.3.198.10 like gate for me

Toshi_Esumi

Leave IP area blank on the physical/parent interface. That's a non-tagged interface. Then you should sniff traffic on the vlan 901 interface (diag sniffer packet VLAN_INTERFACE_NAME) to get any clue for what's going on.

sw2090

that is correct so far because you already have an interface in that network. Just the ip must not be on the physical interface but on the vlan 901 interface!

As you have an Interface in that Network you don't need a static route because the interface already knows the routing for that subnet.

What you have to have - like said some posting above - is static routes for the 10.3.10x.0/29 subnets. And these have to have the vlan interface as interface and 10.3.198.10 as Gateway.

Additionally you still will have to set up policies to allow traffic from mynetowrks to 10.3.10x.0/29.

-- 

"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

-- "It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
______mih_ai______

I ask provider which type of port he use, it was access, he change type of port to trunk.

I create interface under physical and now i can ping him gate 10.3.198.1

But static route doesn't work.

I exec "diag sniffer packet" 

see attach all in one.

sw2090

as I said: you dont need a static route for 10.3.198.0/24 since there is an interface in that subnet on your FortiGate. 

You do need static routes for 10.3.100.0/29, 10.3.101.0/29,10.3.102.0/29,10.3.107.0/29 and 10.3.110.0/29 with 10.3.198.1 as Gateway and the vlan 901 interface as interface.

 

And then you need Policies to allow traffic from your networks via your FGT and the transit vlan to those subnets mentioned above.

 

-- 

"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

-- "It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
______mih_ai______

yes it's my fall that i use wrong gate, now i set 10.3.198.1

I found problem in routing:

Routing entry for 10.3.107.0/29   Known via "static", distance 10, metric 0     10.3.198.1, via transit vlan Routing entry for 10.3.107.0/29  Known via "connected", distance 0, metric 0, best   * is directly connected, VLAN107

 

How i can change best routing for vlan107?

I try change distance and set priority, but it doesn't work.

I don't use route-map

sw2090

hmm...what is the Interface "connected"?

Do you have a misconfigured interface?

Alas you could change die Priority/Distance of your route but you cannot influnence routes that come automagically like net routes over physical or vlan interfaces....

You must not have configured any interface for 10.3.107.0/29 on your FGT. You should only have a static route and at least one policy to allow the traffic.

-- 

"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

-- "It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
______mih_ai______

Hello

I create vlan under physical interface see attach in post 6.

Before i don't understand how create traffic policy rules without interface for 10.3.107.0

But now I understand how I should have been created interface and rules.

 

If port access on provider side set on physical adapter set ip 10.3.198.10, if trunk to under physical adapter create vlan 901 with ip 10.3.198.10

create static route for 10.3.107.0 with gate 10.3.198.1

create Address for 10.3.107.0/29

Create ip4v policy from provider to lan1: 

Incoming Interface  transit vlan 

Outgoing Interface lan1

Source 10.3.107.0 

Destination all

 

 

Thanks all

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors