VLAN on WAN interface

[Brendan]

Hi All,

Our new ISP requires VLAN100 on WAN. We have a FG30E which is bridged via modem (all working previously on ADSL - old ISP)

I since created a VLAN interface, IPv4 policy, and route. I may be missing something, but we're not getting internet access. The Interface status is connected, with all ISP assigned IP's etc. (which aren't the IP settings we're supposed to have) however still unable to ping external.

If i remove the FortiGate, and replace with the ISP provided router, boom.. All working, and get the correct IP assigned.

Config changes below;

edit "VLAN100" set vdom "root" set mode pppoe set allowaccess ping https fgfm set role wan set snmp-index 5 set username "user@isp.com.au" set password ENC password set interface "wan" set vlanid 100 next

edit 6 set name "oubound" set srcintf "lan" set dstintf "VLAN100" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "ALL" set nat enable next

Static Route;

Destination = 0.0.0.0/0.0.0.0 

Gateway = 0.0.0.0

Interface = VLAN100

Appreciate any help!

[tanr]

A few thoughts.

1.  Do you really need https and fgfm access on your wan interface?  Security issue.

2. Have you set mtu properly for your pppoe interface?

3. Just in case, did you double-check your username/pw?

4. What does diag debug  application pppoed -1 show?

Discussion of this at https://forum.fortinet.com/tm.aspx?m=129494 might help.

[emnoc]

I would do the following

diag sniffer packet  VLAN100

diag sniffer packet  wan " ether proto 0x8864"

or  better

diag sniffer packet  wan " not ether proto 0x800  and not  0x806"

 Do you see any PPPoE session packets? what output do you get

[Brendan]

Hi Tanr,

1.  Do you really need https and fgfm access on your wan interface?  Security issue. No, but I do have remote access locked down to local lan, and my external IP only. Would this still be a concern? 2. Have you set mtu properly for your pppoe interface? I haven't modified. I will check and compare with ISP's working router. 3. Just in case, did you double-check your username/pw? Yes, I've check multiple times - The WAN/VLAN100 is connecting, just appears to be assigned the wrong IP from ISP? This part has be concerned 4. What does diag debug  application pppoed -1 show? - I'll try this when i'm back on-site.

I have checked https://forum.fortinet.com/tm.aspx?m=129494 and the other articles on VLAN WAN on these forums. Pretty much have done exactly the same thing, so diag i suppose is the next step.

Hi Emnoc

Thanks for the commands. I'll also try these. As it's a FG30E, is diag shown only in real-time? or is it logged so I could check past events etc.? 

I may be able to configure the existing modem to VLAN100, and just straight PPPoE the WAN port on the FortiGate - If i can't get the FortiGate VLAN100 to work.

I am new to Fortinet devices, and so have only dabbled in their CLI.

Thanks and appreciate the suggestions!

[emnoc]

It's realtime so you don't have to worry ;)

[brendanjmain]

yeah i have spent hours on a remote session with Fortinet Senior tech today and tested 5.6.2, 5.4.5 with FWF-50E-2R and Fortiguard services aren't reachable, some websites and can't use Fortiguard DDNS as it can't see the public IP address on the VLAN interface (and also thinks it is down) but mostly everything else works

Am going to wipe and try firmware 5.2.x and see if it is a bug in 5.4.x and 5.6.x

Will let you know the results

I have FTTB (VDSL) with TPG which requires VLAN 2 on WAN port, I have a Netgear DM200 VDSL modem in bridge mode in front of it

[Brendan]

Hi Guys,

Just wanted to let you all know, the issue ended up being a wrong password provided directly by the ISP!

Twice, they sent me an incorrect password via email which should have been a copy + paste job (both times with a different letter in the wrong case). 

I ended up calling their support, speaking with a capable tech who instantly knew the issue was credentials based on the fact i wasn't getting the assigned IP, and gave me the correct one over the phone and boom! All working..

Sorry for the delay, only got this issue sorted last week - A month after the ticket was logged with the ISP's support haha

Cheers for all the help!

[brendanjmain]

Yeah I solved issue to, don't use a Netgear DM200 as you can't set the VLAN ID on the modem in bridge mode

Changed modem to TPlink VR600 which when in Bridge mode allows to still set VLAN ID 2 and then don't require VLAN interface under WAN on Fortinet Firewall

PPoE auth on WAN interface on Firewall works fine