Trying to create a Sub-Interface on Vlan 1 without much luck

[Kemo]

I have a situation where I have 4 unique subnets.

192.168.0.0/24

192.168.1.0/24

192.168.2.0/24

192.168.3.0/24

Currently, there are no Vlans defined on the switch, so they are all in VLAN 1.  A Cisco router is currently serving as a Gateway for this site and has the following

interface GigabitEthernet0/0/0

  ip address 192.168.0.1 255.255.255.0

  ip address 192.168.1.1 255.255.255.0 secondary

  ip address 192.168.2.1 255.255.255.0 secondary

  ip address 192.168.3.1 255.255.255.0 secondary

I would like to slip in a Fortigate Firewall to serve as the gateway device, but i need a way to service all of the subnets that are all residing in Vlan1 over a single ethernet cable.  I have tried to give the port a parent IP address, similar to Cisco, with secondary ip addresses...but i cant ping from the network to the respective secondary ip address and vice-versa.  The parent ip address works fine.  any ideas?  I have tried configuring the Cisco port as a trunk and access port with no change either way.  i would think my las option would be to have a dedicated port for each subnet, but i would rather keep it to one.

any help is greatly appreciated, 

Steve K. in Austin TX

[Toshi_Esumi · Accepted solution]

You said you added another "interface" on VLAN1 on the Cisco SW. Is it the secondary IP? If Cisco SW is working as L2 switch, unless the FGT port1 config has the same subnet configured as its secondary IP, the FGT can't accepts packet from the switch side because the source IP is not in side of port1's untagged interface subnet.

And, as I said before, FGTs don't accept vlan-id 1 when you try configuring the VLAN subinterface. It might accept the config but just doesn't work.

You just need to match the config between the Cisco switch and the FGT. If untagged, it has to be in the port1 config (means secondary IPs if multiple). If VLANs, the same matching VLAN subinterfaces need to be configured on the port1.
This is the same when you have another Cisco switch and connnects it to the current Cisco switch over a trunk port.

Toshi

[Kemo]

thanks again for replying...

to verify...i have a single cable coming from the Fortigate to the Cisco, and it is configured to be a trunk from the Cisco config.

as you mentioned, i was not able to get a VLAN interface to work using VLAN ID 1.  It let me configure, but it wont work (thats what threw me for a loop).  However, I was able to assign an address to the physical port in Fortigate that falls in my vlan 1 subnet and it worked fine.  i was then able to create multiple VLAN type sub-interfaces in any vlan except vlan 1.  I was then able to create secondary ip addresses under the physical port which all seemed to work well as long as the devices on the network were residing in Vlan1.

thanks for helping me understand the limitations of the product.  and i think you have answered all my questions.

[Toshi_Esumi]

I wouldn't call it limitations. FGT is just different from Cisco SW. A different device requires different config to make the same things work.

Toshi