VLANS in Transparent mode - unable to pass traffic.

[FatalHalt]

Hey guys. I'm trying to get this transparent vdom going to make sort of a 'safe zone' if you will - but I'm having a heck of a time. I have a transparent VDOM called 'lab', which is assigned ports 1-4. Ports 1 and 2 are configured to use a VLAN 18 (eventually there will be a second VLAN on these interfaces, but right now I'm just trying to get one to work). And Ports 3 and 4 will be carrying a separate VLAN (but again, just focusing on the 18 for now). 

Everything else works. If I 'skip' this firewall and just wire the external switch into my lab switch, things work fine. I've caught a few logs which seem to indicate that the traffic is coming into 'vlan.18.lab', having it's tag stripped (as the documentation implies it should), and then being passed out port 2, not 'vlan.18.ext'. Anyone have any thoughts??

 config system interface

    edit "vlan.18.lab"

        set vdom "lab"
        set forward-domain 18
        set snmp-index 29
        set interface "port1"
        set vlanid 18
    next

    edit "vlan.18.ext"
        set vdom "lab"
        set forward-domain 18
        set snmp-index 30
        set interface "port2"
        set vlanid 18
    next

config firewall policy
     edit 7
        set srcintf "vlan.18.lab"
        set dstintf "vlan.18.ext"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set logtraffic all
    next
    edit 8
        set srcintf "vlan.18.ext"
        set dstintf "vlan.18.lab"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set logtraffic all
    next

[FatalHalt]

Anyone have any thoughts on this? I imagine it's very likely that I'm just not seeing the a stupid little problem here. 

[ashukla_FTNT]

As the packets are switched based on the bridge table the first thing to check is on which interface the destination mac of the packet is listed on. Check the following first:

diagnose netlink brctl name host root.b

check what is the destination mac in the packet and on which port it is listed from the above output.

Also post the output of following while sending the traffic

diag sniff packet any 'host <destination ip>' 6 0 a

[Paul_Dean]

@FatalHalt Did you get anywhere with this issue? I'm seeing something similar.

[emnoc]

is the traffic tagged or not? I see one port with tagging and the other with none. Since you mention it works with a cable passed directly, I wondering  if your forward domains is the issues?

Also did you run a diag debug flow

[Kenundrum]

On my transparent mode setup, i created separate vlans for "secured" and "unsecured" traffic because everything was on one logical switch, but if you're using two different switches, you should be ok there using the same vlan. What i did find is that the bridge table was being broadcast on the interface both with and without the vlan tags so the switch didn't know where to send the traffic since it was seeing the same mac address in multiple places.

My fix was to create a blackhole for untagged traffic on the switch ports that connected to the fortigate. I set the default vlan for untagged traffic to 999 and then disallowed vlan 999 traffic on those ports. Make sure whatever vlan you set is actually not ever going to be used for legitimate traffic.