Users segment cant reach server zone interface.

[searching1]

Hi All,

I'm working with my lab right now and having some issue with user segment reaching server zone interface.

Devices 

Fortigate: 100D

Switch: 3850

Fortigate Configuration details:

1. Network Interface

Port 1 (Created interface and zone)

int port1.400 (Outside interface)

allow ping http https snmp

assigned under outside zone

int port1.200 (Server interface)

allow ping http https snmp

assigned under Server zone

2. Routes

Add static route to destination 192.168.10.0/24 to nexthop 172.1.1.2(Switch SVI)

3. Policy 

Create a policy from src zone outside to dst zone server that allow all ip and services.

Switch Configuration details:

1. ip routing

2. created vlan 400(for Outside interface). 10(for user sengment)

3. Create a SVI for vlan 400 with ip 172.1.1.2/24

4. Create a static route to 192.168.200.0/24 pointing to nexthop 172.1.1.1

No filtering configured on switch side. 

What would be the possible issue? Attached the photo and ping test.

Thank you 

[TheJag_FTNT]

You don't technically need the svi for for vlan 10 as the gateway is on the firewall, but vlan 10 does need to be added to the Cisco switch. You will need a policy from server to user... I don't see that listed anywhere unless I'm missing something...