Trying to create a Sub-Interface on Vlan 1 without much luck

[Kemo]

I have a situation where I have 4 unique subnets.

192.168.0.0/24

192.168.1.0/24

192.168.2.0/24

192.168.3.0/24

Currently, there are no Vlans defined on the switch, so they are all in VLAN 1.  A Cisco router is currently serving as a Gateway for this site and has the following

interface GigabitEthernet0/0/0

  ip address 192.168.0.1 255.255.255.0

  ip address 192.168.1.1 255.255.255.0 secondary

  ip address 192.168.2.1 255.255.255.0 secondary

  ip address 192.168.3.1 255.255.255.0 secondary

I would like to slip in a Fortigate Firewall to serve as the gateway device, but i need a way to service all of the subnets that are all residing in Vlan1 over a single ethernet cable.  I have tried to give the port a parent IP address, similar to Cisco, with secondary ip addresses...but i cant ping from the network to the respective secondary ip address and vice-versa.  The parent ip address works fine.  any ideas?  I have tried configuring the Cisco port as a trunk and access port with no change either way.  i would think my las option would be to have a dedicated port for each subnet, but i would rather keep it to one.

any help is greatly appreciated, 

Steve K. in Austin TX

[Toshi_Esumi]

Follow this KB to configure multiple secondary IPs. I don't know how many you can configure, but with my test, I could at least configure 3 secondary IPs, which you need.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Set-a-secondary-IP-on-a-FortiGate-interfac...

Toshi

[funkylicious]

what @Toshi_Esumi gave you should do the trick.

as per how many can be configured, according to https://docs.fortinet.com/max-value-table ,system.interface:secondaryip 256

you just need to leave the switch interface in access mode vlan 1 and configure all the IPs on the FGT interface connected to that port, make sure to enable administrative access ping on all in order for them to reply to ICMP.

L.E. you might need to create firewall rules from portX subnetA to portX subnet B in order to allow traffic, dont recall if they can 'talk' to each other implicitly/by default.

[Kemo]

thanks for the quick reply!  in my case, i was able to create the sub-interfaces without issue using the same procedure you recommend.  However, i was not able to ping those secondary ip addresses from other devices residing in the same subnet...can you try using ip addresses from different subnets in your test lab?

[Toshi_Esumi]

I just tested the creation of three secondary IPs. Didn't connect to anywhere else. What do you see in sniffing like
"diag sniffer packet [interface_name]"
when you pinged from the other side (Cisco side)? Are those ping packets coming in?

Toshi

[Toshi_Esumi]

Ok, I think you just need to allow ping on those secondary IPs.

config secondaryip
  edit 1
    set ip 192.168.2.1 255.255.255.0
    set allowaccess ping
  next

Toshi

[Kemo]

Toshi, 

thanks again for replying...after "redoing" some things...it seems that what you proposed is indeed working in my test lab. Im not sure what i did differently as i do believe i checked the ping box on the secondary interfaces.  At this point i would call this question answered.  So thank you again.  I have other questions concerning "sub-interfaces" with Vlans and i may generate another question in the forums.

thanks again, 

Steve K. in Austin TX

[Kemo]

and i also think i may have confused the verbiage a bit as there is a difference between a "secondary" ip address and a "sub-interface".  the secondary is an ip address, in addition to, the primary ip address with no trunk involved.  On the other hand, a Sub-Interface requires that you define a VLAN ID.  I have been able to define many sub-interfaces.  also, the port on the cisco switch where im using sub-interfaces is trunked.  all devices are communicating in the respective vlans work without issue.  With the exception of anything on VLAN 1.  i cannot define a sub interface using VLAN 1 that works.    ideally, i would have a redundant interface with sub-interfaces for each VLAN i need to service.  so far, im at a loss as i cant get it to work with a single port, much less a redundant link.  

[Toshi_Esumi]

Not exactly sure about the "sub-interfaces" on the Cisco switch you're talking about. Can you share some switch config?

FGTs don't have (or not allowed) VLAN1. The physical interface config is for untagged interface. Then when you configure those VLAN "sub-interfaces" on the physical (or aggregated) interface, it acts as a trunk port.

Toshi

[Kemo]

i will explain the best i can with the simplest test i did.  I have a single cable coming from port1 on the Fortigate to the Cisco switch.  this port is set to trunk in Cisco.

On the fortigate port, i have configured a few vlan interfaces with vlans 2 and 3.

i have a device plugged into the Cisco and this port is set to VLAN2.

I have another device plugged into the Cisco and this port is set to VLAN3.

And finally, i have a device plugged into the Cisco that has not had any configuration and is in VLAN1 by default.

i have ping enabled on the vlan interfaces under port 1 and i can ping back and forth from the fortigate to the devices within their respective Vlans.

When i attempt to add another VLAN interface using VLAN1, i am not able to ping back and forth on VLAN1.  the other devices in VLAN2 and VLAN3 continue to work just fine.

on a side note, I was able to delete the VLAN1 interface under port1 and add an ip address from the VLAN1 range and was able to ping the device in VLAN1 without issue.  So it seems that in order to communicate on VLAN1 you must use a physical port and not a VLAN interface (which i was calling a sub-interface).  I was then able to add secondary ip addresses to the physical port1 under the primary interface without issue.

is this the expected behavior or is it possible to build a VLAN interface using VLAN1 under a physical port?

thanks again for all your help, Ive been learning alot about how all this fits together.

Steve