Good afternoon, I currently have a Fortigate 80E. which has 2 ports used, in port 1 comes vlan 4 and in port 2 enters vlan 2. But I can't find a way to route them to each other. If I create static routes on Windows PC using my switch as a gateway, they ping each other, but I cannot route the entire vlan.


enter image description here

Other VLAN

enter image description here At the moment I only have these two policies. I had created static routes, but they didn't work and I deleted them.

  • Please edit your question to include the full (sanitized) Fortigate configuration. We cannot guess where you may have gone wrong in the configuration. Your Windows PC configuration is off-topic here, and you can ask about it on Server Fault for a business network.
    – Ron Maupin
    Nov 6, 2019 at 14:47
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 15, 2019 at 20:17

3 Answers 3


You don't need static routes on the FGT when it's directly connected to each subnet, (tagged) VLANs or plain. A router only requires routes to remote subnets that it can't see itself.

Clients in each subnet either need the FGT as default gateway or a route to the other subnet(s). Each client needs to be able to ping its gateway(s) - make sure you've enabled PING on the FGT interface at least temporarily.

As a firewall, the FGT defaults to deny any traffic unless it is permitted by a firewall rule. Your rules look like they should work but if they don't you need to provide the configuration. Make sure the rules are not behind/below other rules denying the traffic, the FGT applies the first/topmost rule that matches the traffic.

Alternatively, you check the Forward Traffic log to see if the rules match and what's going on.

  • I did the test of routing 2 vlans that enter through the same port and it works, but when I try to route 2 vlans that enter through a different port it doesn't work. Each subnet can ping your gateway! Nov 6, 2019 at 15:27
  • @IgnacioCopparoni Without more configuration details we won't be able to help you...
    – Zac67
    Nov 6, 2019 at 15:53
  • Please, tell me what more details you need so I provide them! Nov 6, 2019 at 16:03
  • At the very least, we need the interface/VLAN configs and the firewall rules. The routing table won't hurt either.
    – Zac67
    Nov 6, 2019 at 16:05

Resolved. The configuration of the publication is correct.

The problem was that the PC had a static route directed to the sub network of the vl4 and that caused the error.

It was also confirmed that the vlans existed in both switches

  • See Clients in each subnet either need the FGT as default gateway or a route to the other subnet(s). in the other answer...
    – Zac67
    Nov 6, 2019 at 17:45

You can Check your PC and tracert Destination via CMD, then you can find Problem, I assum problem is on your pc and you dont have route to Fortigate. you can set static route via

route add mask gw 192.168.2.x(Fortigate Interface IP) in 192.168.2.x Side

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.