Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor II

VLAN configuration

Dear All,


few months ago I configured VLAN on my network and it worked corectly. After I have changed router to FTG 80C (5.2.5) the VLAN stopped working. I use HP switch which supports VLAN - I didn't change the configuration on it. I use on FTG advanced routing.


Idea is:


VLAN - - access to Internet but no access to LAN


Fortigate <-> hp switch (VLAN <-> tp-link switch (WAN


I added on FTG VLAN interface and policy VLAN -> WAN.


When I am connected to tp-link I have no access to Internet - I can ping but I can't ping (VLAN interface on Fortigate). I think that I should add some Static Routes or Policy Routes?

Thank You in advance,



2 Solutions
New Contributor II

Sorry for second post but I can only one attachment upload. Please see VLAN information form HP switch.

View solution in original post


I think the error is

"id=20085 trace_id=1 func=ip_route_input_slow line=1273 msg="reverse path check fail, drop""

That means that you are missing a route for (I guess) behind WiFiguests.

Once you add that static route, try again.

If you still can't access, try to run another debug and attach the file.


By the way, I suggest you give another check to your firewall policies and routing.



View solution in original post


Run diagnose debug again and let's see what happens.

New Contributor II

I found bug ... I set up wrong mask on VLAN interface - was, today I've changed to and it works :)


Esteemed Contributor III

That's not a bug, that's human error ;)


btw, fortiOS is flawed in it allows a  /32 on 802.1.q  interfaces but the catch ;


it will not be present in your  route table as  a connect  route

it will not  be present from  routing all output

and only the get router info  kernel  output will show the route





New Contributor II



thank You for answers. Please see network scheme. When I'm connected to WIFI Guest I can ping but not I can't ping - so this is not dns problem. When I'm connected to LAN (192.168.1.XXX) I can ping but not - I think it is ok. Internet works ok on LAN network.