0

Good afternoon, I currently have a Fortigate 80E. which has 2 ports used, in port 1 comes vlan 4 and in port 2 enters vlan 2. But I can't find a way to route them to each other. If I create static routes on Windows PC using my switch as a gateway, they ping each other, but I cannot route the entire vlan.

Configs:

enter image description here

Other VLAN

enter image description here At the moment I only have these two policies. I had created static routes, but they didn't work and I deleted them.

Improve this question
  • Please edit your question to include the full (sanitized) Fortigate configuration. We cannot guess where you may have gone wrong in the configuration. Your Windows PC configuration is off-topic here, and you can ask about it on Server Fault for a business network. – Ron Maupin♦ Nov 6 '19 at 14:47
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin♦ Dec 15 '19 at 20:17
0

You don't need static routes on the FGT when it's directly connected to each subnet, (tagged) VLANs or plain. A router only requires routes to remote subnets that it can't see itself.

Clients in each subnet either need the FGT as default gateway or a route to the other subnet(s). Each client needs to be able to ping its gateway(s) - make sure you've enabled PING on the FGT interface at least temporarily.

As a firewall, the FGT defaults to deny any traffic unless it is permitted by a firewall rule. Your rules look like they should work but if they don't you need to provide the configuration. Make sure the rules are not behind/below other rules denying the traffic, the FGT applies the first/topmost rule that matches the traffic.

Alternatively, you check the Forward Traffic log to see if the rules match and what's going on.

Improve this answer
  • I did the test of routing 2 vlans that enter through the same port and it works, but when I try to route 2 vlans that enter through a different port it doesn't work. Each subnet can ping your gateway! – Ignacio Copparoni Nov 6 '19 at 15:27
  • @IgnacioCopparoni Without more configuration details we won't be able to help you... – Zac67 Nov 6 '19 at 15:53
  • Please, tell me what more details you need so I provide them! – Ignacio Copparoni Nov 6 '19 at 16:03
  • At the very least, we need the interface/VLAN configs and the firewall rules. The routing table won't hurt either. – Zac67 Nov 6 '19 at 16:05
0

Resolved. The configuration of the publication is correct.

The problem was that the PC had a static route directed to the sub network of the vl4 and that caused the error.

It was also confirmed that the vlans existed in both switches

Improve this answer
  • See Clients in each subnet either need the FGT as default gateway or a route to the other subnet(s). in the other answer... – Zac67 Nov 6 '19 at 17:45
0

You can Check your PC and tracert Destination via CMD, then you can find Problem, I assum problem is on your pc and you dont have route to Fortigate. you can set static route via

route add 192.168.4.0 mask 255.255.255.0 gw 192.168.2.x(Fortigate Interface IP) in 192.168.2.x Side

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.