VLAN to VLAN?

[thegreatwhay]

Good afternoon. I have stated before that I do not proclaim to be a firewall expert. I have a Fortigate 110C that I am trying to give all users on a different VLAN have access to ONE address on another VLAN. I have searched through my documentation and have not found answers on how to do this. I have created 2 polices that allow for all addresses on one VLAN to have access to the one address on the other VLAN and vise-verse. What am I missing in this procedure? Any thoughts or recommendations? Thanks in advance Peeps.

[emnoc]

Each vlan interface looks like another layer3 interface. So what is your problem and have you validate the policies are correct? If you assigned a unique l3 subnet on each vlan interface, enable 802.1q on the switchport and have the users in the appropiate vlans, they they should beable to communicate. diag debug flow is your friend, but I would 1st check layer2 and ensure clients in vlan xyz , can at least ping gateway ip_address of the fgt in vlan xyz and same for clients in vlan abc , can ping their respective gateway of the FGT in vlan abc. note: rule out the lower layers before moving on.

[thegreatwhay]

emnoc, Thanks for the reply. Sadly, I have to say that at the moment, I do not know the difference between level3 interface vs. a level2 or 1? Either way, I am trying to find whre the 802.1q enabling feature is. Is this done through the Network menu? I am going to investigate what you have written better tonight when I can look some definitions up and what not...so thank you for your reply. I am not 100% I have the policies correct, but I am 80% sure. I say this, because I am not experienced enough to be confident in what I am doing.

[emnoc]

L3 = layer3 ( ip routing ) L2 = layer2 802.1q is a layer2 protocol and once you build the vlan' d subinterfaces you assigned layer3 information to them. The switchport that your on, need 802.1q enable and the appropiate vlans created Here' s a FGT with a few layer3 subinterfaces built for port2 edit " PV_NET01" set vdom " root" set ip 10.200.210.1 255.255.254.0 set allowaccess ping https ssh set description " misc network #1" config ipv6 set ip6-address 2001:xx:xxa:4::1/64 set ip6-allowaccess ping https ssh end set interface " port2" set vlanid 50 next edit " PV_NET02" set vdom " root" set ip 10.200.211.1 255.255.254.0 set allowaccess ping https ssh set description " misc network #2" config ipv6 set ip6-address 2001:xx:xxa:5::1/64 set ip6-allowaccess ping https ssh end set interface " port2" set vlanid 51 next The Port 2 is set up for trunking on the switch side of things; eg ( using the nexus we are plugged on ) interface Ethernet1/30 description mia-dc firewall fgt#1 port2 switchport mode trunk switchport trunk native vlan 999 switchport trunk allowed vlan 50,51 logging event port link-status udld aggressive Once you build the 802.1q subinterfaces on the FGT and then allowed vlan 802.1q on the physical switchpoprts. You apply L3 fwpolicy just like any other interface. btw: I like to use names on my subinterfaces or make references to the vlan; e.g I could have written it like; re' s a FGT with a few layer3 subinterfaces built for port2 edit " vlan50" set vdom " root" set ip 10.200.210.1 255.255.254.0 set allowaccess ping https ssh set description " misc network #1" config ipv6 set ip6-address 2001:xx:xxa:4::1/64 set ip6-allowaccess ping https ssh end set interface " port2" set vlanid 50 next edit " vlan51" set vdom " root" set ip 10.200.211.1 255.255.254.0 set allowaccess ping https ssh set description " misc network #2" config ipv6 set ip6-address 2001:xx:xxa:5::1/64 set ip6-allowaccess ping https ssh end set interface " port2" set vlanid 51 next etc..... I hope that make better sense and clears up the picture.

[thegreatwhay]

emnoc, I am just now getting back to trying to resolve this problem. The nature of my business has not allowed for me to focus on this at the moment.. So now, I am back. As I read through the CLI config, I realized that you are possibly using the unit in switch mode. I am currently using the unit in interface mode. Am I just misunderstanding? Thanks, J

[osaid]

Dear all, i have issue with VLAN, i have blade switch connected to cisco catalyst switch 2970,and this switch(2970)connected to fortigate 310-b with 2 ports, with blade switch i setup port connected to Cisco switch as trunk,what should i do in cisco switch and in FG that connected to cisco switch with 2 ports..? Regards

[Jan_Scholten]

looks like you are in interface mode.. Where are your VLANs connected? (Which Port? Where do the Users/VLANs reside - on a other switch? Which VLANs should communicate? " Normally" : Userports are on a seperate VLAN aware switch (Cisco, Alcatel, HP, you name it). - You connect one Uplink from the switch to the fortigate and tag (802.1q) all Vlans you want to have run through the fortigate- - create VLAN Subinterface on the port of the Fortigate, that connects the above tagged port (for each Network->Interface->Create New on the corresponding HW Interface. VLAN ID is the VLAN Number) - Have each VLAN Interface with an IP Adress from the VLAN (ideally make it the default Gateway for the subnet, otherwise have routes for the other subnets on each Client) - Create Policys VLAN1 Source IP: IP Network of VLAN1 -> VLAN 10 (Special IP) VLAN2 Source IP: IP Network of VLAN2 -> VLAN 10 (Special IP) VLAN3 Source IP: IP Network of VLAN3 -> VLAN 10 (Special IP) ... You do only need the way Back (VLAN 10 -> VLAN 1-X) when you have connections build up from the Special IP. You could probably use the any interface (Any -> Special IP), but i dislike that. hth