IP Address of virtual-switch (hardware-switch) not in routing table

[lucablanc]

Hi all,

I'm very new on fortigate firewall.

I'm configuring a FG100D, it's running in "interface mode" and I need to bridge 2 interfaces, so I created a virtual-switch: I tried both GUI and CLI, then I set an IP Address on the interface "Virtual-Switch".

Testing with a ping, I can reach 2 devices connected to virtual-switch, but in "Routing->Monitor" there is not entry with the net assigned to VS, I also create some static routes and, of course, those routes are not in routing table.

Software-switch works well.

Do you have any suggestion?

This my virtual-switch config:

config system virtual-switch edit VS01 set physiscal-switch sw0 config port edit port 9 end edit port 10

[Toshi_Esumi]

I'm assuming you used "get router info routing-t all" to see the table. Do you see anything differently if you try "get router info routing-t database"?

[Toshi_Esumi · Accepted solution]

Also do you happen to have multi vdoms on the 100D?

[lucablanc]

I have only root VDOM.

[lucablanc]

I checked routing table using webgui.

The worst effect is static routes with as next hop an IP on the subnet of hawrdware switch don't work.

[MrSinners]

Often there is some misconfiguration that prevents a network to end up in the routing table, for example a VIP or IPPOOL. Can you share config? May I ask why you need 2 ports bridged? Are they going to 2 seperate unmanaged switches?

[AlexFeren]

Handbook - "When traffic is forwarded among interfaces belonging to the same virtual switch, the traffic doesn't need to go up to the software stack, but forwarded directly by the switch ..."

The way I read this is that 'system virtual-switch' creates a purely L2 switch (ie. no L3, hence no routing).

On my 60D, I did set up 'system switch-interface' (ie. software equivalent of physical 'system virtual-switch') and it does show up in routing table:

FG60C (Test-NAT) # show system switch-interface config system switch-interface     edit "XX"         set vdom "Test-NAT"         set member "internal1"     next end

FG60C (Test-NAT) # show system interface XX config system interface     edit "XX"         set vdom "Test-NAT"         set ip 1.1.1.1 255.0.0.0         set type switch         set snmp-index 7     next end

FG60C (Test-NAT) # get router info routing-table connected C       1.0.0.0/8 is directly connected, XX

[lucablanc]

No VIP or IPPOOL configured.

The system was as default, I changed only the system mode from "switch" to "interface".

I need to bridge the interfaces because I have a couple or routers in VRRP that are managing L3VPNs and I didn't want install an other switch.