Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Brendan
New Contributor

VLAN on WAN interface

Hi All,

 

Our new ISP requires VLAN100 on WAN. We have a FG30E which is bridged via modem (all working previously on ADSL - old ISP)

 

I since created a VLAN interface, IPv4 policy, and route. I may be missing something, but we're not getting internet access. The Interface status is connected, with all ISP assigned IP's etc. (which aren't the IP settings we're supposed to have) however still unable to ping external.

 

If i remove the FortiGate, and replace with the ISP provided router, boom.. All working, and get the correct IP assigned.

 

Config changes below;

 

edit "VLAN100" set vdom "root" set mode pppoe set allowaccess ping https fgfm set role wan set snmp-index 5 set username "user@isp.com.au" set password ENC password set interface "wan" set vlanid 100 next

 

edit 6 set name "oubound" set srcintf "lan" set dstintf "VLAN100" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "ALL" set nat enable next

Static Route;

Destination = 0.0.0.0/0.0.0.0 

Gateway = 0.0.0.0

Interface = VLAN100

 

Appreciate any help!

7 REPLIES 7
tanr
Valued Contributor II

A few thoughts.

 

1.  Do you really need https and fgfm access on your wan interface?  Security issue.

 

2. Have you set mtu properly for your pppoe interface?

 

3. Just in case, did you double-check your username/pw?

 

4. What does diag debug  application pppoed -1 show?

 

Discussion of this at https://forum.fortinet.com/tm.aspx?m=129494 might help.

emnoc
Esteemed Contributor III

I would do the following

 

 

diag sniffer packet  VLAN100

diag sniffer packet  wan " ether proto 0x8864"

 

or  better

 

diag sniffer packet  wan " not ether proto 0x800  and not  0x806"

 Do you see any PPPoE session packets? what output do you get

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Brendan
New Contributor

Hi Tanr,

 

1.  Do you really need https and fgfm access on your wan interface?  Security issue. No, but I do have remote access locked down to local lan, and my external IP only. Would this still be a concern? 2. Have you set mtu properly for your pppoe interface? I haven't modified. I will check and compare with ISP's working router. 3. Just in case, did you double-check your username/pw? Yes, I've check multiple times - The WAN/VLAN100 is connecting, just appears to be assigned the wrong IP from ISP? This part has be concerned 4. What does diag debug  application pppoed -1 show? - I'll try this when i'm back on-site.

 

I have checked https://forum.fortinet.com/tm.aspx?m=129494 and the other articles on VLAN WAN on these forums. Pretty much have done exactly the same thing, so diag i suppose is the next step.

 

 

Hi Emnoc

 

Thanks for the commands. I'll also try these. As it's a FG30E, is diag shown only in real-time? or is it logged so I could check past events etc.? 

 

I may be able to configure the existing modem to VLAN100, and just straight PPPoE the WAN port on the FortiGate - If i can't get the FortiGate VLAN100 to work.

 

I am new to Fortinet devices, and so have only dabbled in their CLI.

 

Thanks and appreciate the suggestions!

emnoc
Esteemed Contributor III

It's realtime so you don't have to worry ;)

 

 

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
brendanjmain

yeah i have spent hours on a remote session with Fortinet Senior tech today and tested 5.6.2, 5.4.5 with FWF-50E-2R and Fortiguard services aren't reachable, some websites and can't use Fortiguard DDNS as it can't see the public IP address on the VLAN interface (and also thinks it is down) but mostly everything else works

 

Am going to wipe and try firmware 5.2.x and see if it is a bug in 5.4.x and 5.6.x

 

Will let you know the results

 

I have FTTB (VDSL) with TPG which requires VLAN 2 on WAN port, I have a Netgear DM200 VDSL modem in bridge mode in front of it

Brendan

Hi Guys,

 

Just wanted to let you all know, the issue ended up being a wrong password provided directly by the ISP!

Twice, they sent me an incorrect password via email which should have been a copy + paste job (both times with a different letter in the wrong case). 

I ended up calling their support, speaking with a capable tech who instantly knew the issue was credentials based on the fact i wasn't getting the assigned IP, and gave me the correct one over the phone and boom! All working..

 

Sorry for the delay, only got this issue sorted last week - A month after the ticket was logged with the ISP's support haha

 

Cheers for all the help!

brendanjmain

Yeah I solved issue to, don't use a Netgear DM200 as you can't set the VLAN ID on the modem in bridge mode

 

Changed modem to TPlink VR600 which when in Bridge mode allows to still set VLAN ID 2 and then don't require VLAN interface under WAN on Fortinet Firewall

 

PPoE auth on WAN interface on Firewall works fine

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors