Hot!Routing Issue between Fortigate 100E and Cisco 3650

Author
dbrady
New Member
  • Total Posts : 12
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/09/05 01:16:01
  • Status: offline
2018/01/08 13:19:03 (permalink)
0

Routing Issue between Fortigate 100E and Cisco 3650

Hey guys,
 
I'm hoping someone can help me. I have recently replaced unmagged switches with a Cisco 3650 switch and setup inter-vlan routing. I have created 4 vlans to segregate the network (vlan10 management, vlan20 servers, vlan30 end user device, vlan40 WiFi AP).
 
I have connected the fortigate (v5.4.5,build6225) to the switch (trunk port) and created the vlans on the fortigate interface connected to the switch. I have setup a default route on the switch to point traffic to the FW (IP in vlan10). the switch can ping all vlan interfaces on the FW but an end user device can't ping the FW. A work around to was enable Asymmetric routing but I understand this to be a test not a workaround.
 
As all traffic from the switch is going over vlan10 I have created the neccesary ipv4 policys to allow this traffic.
 
Can anyone shed some light where I am going wrong please? Attached is the topology.
 
post edited by dbrady - 2018/01/08 13:24:20

Attached Image(s)

#1

14 Replies Related Threads

    ede_pfau
    Expert Member
    • Total Posts : 5564
    • Scores: 374
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: Routing Issue between Fortigate 100E and Cisco 3650 2018/01/09 01:40:21 (permalink)
    0
    hi,
     
    if I don't read your post but only look at the schematics I'd say you don't run a VLAN trunk from the switch to the FGT. So no wonder traffic from the other VLANs doesn't make it to there.
    Have a look at the current Routing Table on the FGT; "get route info rout all" in the CLI, or Routing > Monitor in the GUI. The FGT should have routes for all VLANs.
    The FGT will silently drop traffic it does not have a route for - anti-spoofing. For example, incoming traffic from VLAN40 would be dropped unless there is a route back to where this traffic originated. This can be an explicit route, or the default route.

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    #2
    dbrady
    New Member
    • Total Posts : 12
    • Scores: 0
    • Reward points: 0
    • Joined: 2017/09/05 01:16:01
    • Status: offline
    Re: Routing Issue between Fortigate 100E and Cisco 3650 2018/01/09 01:55:36 (permalink)
    0
    Hi Ede,
     
    Thank you for your reply. I have been thinking about how I have setup this up and i'm thinking of changing it.
     
    Configure the switchport that connects to the FGT as a routed port and give it an IP address on the same subnet as the FW. Create a default route on the switch to the FW and create static routes on the FGT for each VLAN on the switch. This seems like a simplier setup?
    #3
    ede_pfau
    Expert Member
    • Total Posts : 5564
    • Scores: 374
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: Routing Issue between Fortigate 100E and Cisco 3650 2018/01/09 02:17:08 (permalink)
    0
    Sure, this should work as well. You wouldn't need to create VLAN ports on the FGT but...you will have all traffic on that wire, no separation. Creating policies between subnets will work but features involving ports will not, like DHCP servers.
     
    Actually, creating that port as a trunk port for all VLANs should work as well and would not mean much more config on the FGT. But more control, IF you need it.

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    #4
    dbrady
    New Member
    • Total Posts : 12
    • Scores: 0
    • Reward points: 0
    • Joined: 2017/09/05 01:16:01
    • Status: offline
    Re: Routing Issue between Fortigate 100E and Cisco 3650 2018/01/09 02:42:04 (permalink)
    0
    Yes, I think thats what i want to steer away from as its causing issues with my routing. At the moment I have a default route on my switch point traffic to the FW so all traffic is going over VLAN10.
     
    At the moment i have asymmetric routing enabled so LAN traffic is working but as soon as I disable this routing fails.
    #5
    Anurag Goyal
    New Member
    • Total Posts : 14
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/01/02 22:00:42
    • Status: offline
    Re: Routing Issue between Fortigate 100E and Cisco 3650 2018/01/09 04:09:29 (permalink)
    0
    i had this kind of experience with FGT 300C to Cisco 3650 and Ruckus 1100.
    You need to create sub-interface (vlan_interface) under internal ports & define the Vlan ID to the same.
    Example:
    internal 1--- Sub_interface vlan_id 10----define the ip of interface vlan10 (if you have configure in cisco switch your int vlan 10 and assigned ip is 192.168.10.1/24, you can assign 192.168.10.x/24 to fortigate sub interface.
    Do the same as for all remain vlans.
    Connect your switch port's assigned vlan interface with Fortigate's vlan assigned interface.
    Nothing else.

    Attached Image(s)

    #6
    dbrady
    New Member
    • Total Posts : 12
    • Scores: 0
    • Reward points: 0
    • Joined: 2017/09/05 01:16:01
    • Status: offline
    Re: Routing Issue between Fortigate 100E and Cisco 3650 2018/01/09 04:59:05 (permalink)
    0
    Hi Anurag,
     
    Thank you for your reply.
     
    So in your example, i would associate each VLAN its own interface on the switch and FGT. On the switch port assign it an access port to the desired VLAN?
     
    I would not need to put in any default routes on the switch? I also take it i would need to amend my IPv4 Policys to reflect the additional ports created?
     
     
    #7
    Anurag Goyal
    New Member
    • Total Posts : 14
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/01/02 22:00:42
    • Status: offline
    Re: Routing Issue between Fortigate 100E and Cisco 3650 2018/01/09 05:34:24 (permalink)
    0
    yes, exactly!!!!
    if you don't want to consume 4 ports of switch and FGT, you can use only one port of FGT and create sub interface to it, assign vlan ID.
    After that you need to create the policies for appropriate vlan interface communication.

    Attached Image(s)

    #8
    dbrady
    New Member
    • Total Posts : 12
    • Scores: 0
    • Reward points: 0
    • Joined: 2017/09/05 01:16:01
    • Status: offline
    Re: Routing Issue between Fortigate 100E and Cisco 3650 2018/01/09 11:04:28 (permalink)
    0
    Hey guys - I have made the following changes.

    Disabled asymmetric routing on FGT
    Removed ALL VLANS from the FGT.
    Removed all physical ports from the LAN interface apart from port1.
    Configured LAN interface to 10.0.200.1 (FW IP address) and disabled STP.
    Configured the switchport as an access port on VLAN10 and removed STP.
    Connected FGT to switchport
    Put a default route on the switch 0.0.0.0 0.0.0.0 10.0.200.1
    Put static routes on FGT 10.0.3.0/24 (VLAN30) via LAN (10.0.200.10 gateway which is the int VLAN10 on switch)
    Put static routes on FGT 10.0.5.0/24 (VLAN40) via LAN (10.0.200.10 gateway which is the int VLAN10 on switch)
    Put static routes on FGT 10.0.0.0/24 (VLAN20) via LAN (10.0.200.10 gateway which is the int VLAN10 on switch)
    Amended all IPv4 policy to use LAN int

    So far everything looks good. Would you say this is a good way to setup the routing?
    #9
    ede_pfau
    Expert Member
    • Total Posts : 5564
    • Scores: 374
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: Routing Issue between Fortigate 100E and Cisco 3650 2018/01/09 14:19:46 (permalink)
    0
    yep, but halfways only...where are the VLANs on the switch? Why don't you declare the switchport which connects to the FGT as a VLAN trunk and run all 4 VLANs over it?

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    #10
    Anurag Goyal
    New Member
    • Total Posts : 14
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/01/02 22:00:42
    • Status: offline
    Re: Routing Issue between Fortigate 100E and Cisco 3650 2018/01/10 03:52:58 (permalink)
    0
    As did in FGT 300C & cisco3650, I didn't use any extra routing.  I made ipv4 policies to allow access the users to another vlans.
    It is working since 3 years.
    #11
    dbrady
    New Member
    • Total Posts : 12
    • Scores: 0
    • Reward points: 0
    • Joined: 2017/09/05 01:16:01
    • Status: offline
    Re: Routing Issue between Fortigate 100E and Cisco 3650 2018/01/11 03:52:17 (permalink)
    0
    ede_pfau
    yep, but halfways only...where are the VLANs on the switch? Why don't you declare the switchport which connects to the FGT as a VLAN trunk and run all 4 VLANs over it?


    That's how it was setup originally but i had reverse path check issues. So asymmetric routing was enabled as a work around.
    #12
    dbrady
    New Member
    • Total Posts : 12
    • Scores: 0
    • Reward points: 0
    • Joined: 2017/09/05 01:16:01
    • Status: offline
    Re: Routing Issue between Fortigate 100E and Cisco 3650 2018/01/11 03:53:55 (permalink)
    0
    anurag
    As did in FGT 300C & cisco3650, I didn't use any extra routing.  I made ipv4 policies to allow access the users to another vlans.
    It is working since 3 years.


    Can you see any issues with the way I setup mine? I have 1 ipv4 policy instead of multiple if I have the VLANs configured on the FGT.
    #13
    pyy
    Bronze Member
    • Total Posts : 21
    • Scores: 2
    • Reward points: 0
    • Joined: 2015/10/21 10:57:48
    • Status: offline
    Re: Routing Issue between Fortigate 100E and Cisco 3650 2018/01/11 13:33:44 (permalink)
    0
    which is the default gateway for the devices L3 Switch or FG?
    if L3 then why you have subif on the FG
    If just create policies for the intervlan communication or a zone
    #14
    Anurag Goyal
    New Member
    • Total Posts : 14
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/01/02 22:00:42
    • Status: offline
    Re: Routing Issue between Fortigate 100E and Cisco 3650 2018/01/12 05:32:34 (permalink)
    0
    Default gatway for L3 is FG, and yes it for inter vlan communication.
    #15
    Jump to:
    © 2018 APG vNext Commercial Version 5.5