allowing Internet to Vlan

[JaysonRTCC]

• i have made a vlan(192.168.2.1/24) for may APs under my lan switch(192.168.1.1/24)...my problem is im not able to allow or gave the vlan internet access even do i have made policy wifi vlan -> sdwan
• i am able to ping lan address via the ap with a policy wifi vlan -> lan and lan -> wifi lan
• my ap config is that all user connected to ap will be in the vlan. the AP im using is tplink eap320 and engenius ews300ap

am i missing something in my configuration

fg201e

v7.0.5

[vtsonev]

Hello Jayson,

As far as I understand you have the following setup: Internet---Fortigate---Switch---AP---clients

As you mentioned that you have ICMP connection from your AP to the LAN address of the switch  (192.168.1.1), can you please double check if you have ICMP to the Fortigate IP address? Normally you can try to ping the management IP of the Fortigate from you local network.

There are few requirements that you need to follow to obtain internet access to your local network:

1. IPv4 policy to allow the traffic with NAT enabled (from LAN->WAN should be sufficient as the FGT is statefull firewall)

2. Static or dynamic routing entry in your routing table (to confirm please run "get router info routing-table all)

If the routing and the firewall policy are correctly configured than, most likely you have different issue, so please share you findings.

Best regards,

Vasil

[JaysonRTCC]

here is my setup im trying to implement

Internet- - -Fortigate- - -switch- - -AP- - -AP Clients (mobile phone, laptop)

                                                  |

                                        switch clients (desktop, servers)

my lan(192.168.1.0/24) will cover the switch clients and AP while the vlan(192.168.2.0/24) will cover the AP clients. i dont need my ap client be able to communicate with my lan clients. i just need to provide internet to my ap clients.

for the routing table:

Routing table for VRF=0
S* 0.0.0.0/0 [10/0] via 152.32.72.177, wan1, [1/0]
[10/0] via 192.168.18.1, wan2, [1/0]
C 152.32.72.176/28 is directly connected, wan1
C 169.254.1.1/32 is directly connected, Readycon
C 192.168.1.0/24 is directly connected, LAN Switch
C 192.168.5.0/24 is directly connected, JFI office
C 192.168.18.0/24 is directly connected, wan2

Routing table for VRF=2
S* 0.0.0.0/0 [10/0] is directly connected, WiFi Segment, [1/0]
C 192.168.2.0/24 is directly connected, WiFi Segment

[vtsonev · Accepted solution]

Hi Jayson,

Thank you for your update!

I see that you have configured two different VRFs, is that made in purpose or you just overlooked something ? VRF allows multiple routing table instances to co-exist on the same router. One or more interfaces may have a VRF, and packets are only forwarded between interfaces with the same VRF.

In general VRFs are intended to be used in much more complex setups, so would recommend to change the VRF of the WiFi Segment to "0".

The problem here is that your VRF 2 has default gateway via WiFi Segment, which is an internal interface. So basically the packets have no valid route to Internet at the moment. Fortigate receives the packets on WiFi segment and sends them back over the same interface, without forwarding them anywhere.

There are two options that I can recommend based on your setup:

1. Remove the VRF configuration if not necessary (by changing the VRF on WiFi segment to 0) and create an IPv4 policy from Wifi Segment-> wan1. In this case the traffic will start flowing.

2. Keep the VRFs but include wan1 or wan2 which are valid gateway interfaces in VRF2, so the traffic can reach to internet.  Here is an example how you can configure VRF on interface: https://docs.fortinet.com/document/fortigate/6.4.2/administration-guide/752950/configure-a-vrf-id-on...

Best regards,

Vasil

[JaysonRTCC]

option 1 work for me, return wifi segment vrf to zero and internet start flowing. thanks a lot for the help.