VLAN network computers don´t go out to WAN

[ragno]

Hi,

I am needing help to set the fortigate 50-B (4.0 MR3) to connect differents vlans devices to internet.

In this case I have 2 wireless routers, one for the employees laptops and the other for the guests laptops.

All the employees networks (wifi+lan) m ust be in the same vlan 10 and for the guest I want to be in the vlan 50 to contain the risk of virus proliferation and security.

What I did in the switch is to set the vlan ports as "access" with the following tags:

Port 1,2,3 - vlan 10 for the employee desktops Port 10 - vlan 10 for the employees wireless router Port 11 - vlan 50 for the guest wireless router PORT 23 - is connected to the firewall, port set to vlan 10 PORT 24 - is connected to the firewall, port set to vlan 50

The switch is already set do have DHCP for each VLAN and is working fine.

I tried than to access the internet but is not working...What I made wrong in fortigate? 

Please see the attachments.

[emnoc]

diagram looks good :)

Let's start with some basic diagnostic & t-shoot

1: you have wan1+wan2 in the destinations are either of these 2 uplinks to the internet working?

2: are the next-hop gw reachable

3: can the guest/employee lans ping the  fortigate interfaces ( ensure  ping is enabled )

4: do they have there next-hop gateways via  dhcp set to the fotigates inside interface address

5: did you  run diag debug flow ? and if yes what was the outcome? Did the expect fwpolicy-id was matched?

[rwpatterson]

6) Did you enable NAT on the policies that face the Internet?

[Dave_Hall]

Glancing over Eduardo's pics (specifically the firewall policy list), it shows traffic going through the internal interface to WAN1+2, so I'm guessing there is just a problem with the guest wifi network?

Second, the firewall policy list shows firewall policies for what appears to be the main internal interface and the guest vlan interface (VLAN 50).  Where is the the interface for VLAN 10? Could it have the same interface name as the main interface? Are the internal ports on the 50B placed into interface mode?

Technically, tagged VLAN traffic from the Dell switch hitting the Fortigate only needs to go over one port.  That being said, if we are only talking about two separate networks (internal and guest) I would consider just placing the 50B into interface mode (if all possible) and untag the traffic leaving ports 23 and 24 (on the Dell switch) leading to the 50B and not have to deal with VLANS altogether (on the 50B).

7) confirm proper gateway/routing is in place.

[ede_pfau]

Dave, I doubt the 50B is capable of splitting up the 'internal' switch into single ports. VLANs were the only way to have more ports in those days.

[Dave_Hall]

Thought as much.

[SCSIraidGURU]

I had to do several things to properly route VLAN traffic through my 800C.

1.) HP 5800 Layer 3 switch:  I setup a policy based route for each VLAN.  The PBR gave each VLAN a gateway of last resort that pointed to the 800C VLAN address for that VLAN

These rules were need so the VLAN traffic leaving the switch for the internet does not violate reserve packet rules on any firewall.  My previous firewall was Cisco.  We switched to Fortinet last month.  I kept the same rules.   This method fixed HP and Cisco's problem with reverse packets.   Most firewalls will not allow VLAN traffic to come in or out on a different VLAN.  It is considered VLAN spoofing and usually gets blocked.  So you need to use PBR to route the traffic to the firewall. 

2.) 800C:  I setup a policy for each VLAN to go the link balanced connections.  You need outbound rules for each VLAN on the Fortinet.

VLAN 8, 24, and 192 were registered subnets from the ISPs.  I still needed to enable NAT

VLAN 10,20,30 are NAT VLANs.

The incoming interface is the VLAN ###

Outgoing interface is Wan-Load-Balance, if you have one connection it would be WAN1 or WAN2.