Hot!Multiple virtual interfaces

Author
J.One
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/08/07 00:23:39
  • Status: offline
2018/08/07 01:45:31 (permalink)
0

Multiple virtual interfaces

Hello everyone,

I'm trying to setup my 40c with multiple virtual interfaces.
I  simply followed this guide:
http://kb.fortinet.com/kb....do?externalId=FD33738

Which basically comes down to:

#FGT40C-3 # config system interface
#FGT40C-3 (interface) # edit 'myvlan interface'
#new entry 'myvlan interface' added
#FGT40C-3 (test) # set interface internal
#FGT40C-3 (test) # set vlanid 100
#FGT40C-3 (test) # set ip 192.168.100.254/24
#FGT40C-3 (test) # set vdom root
#FGT40C-3 (test) # end

I created the routes:

IP 192.168.100.254/24 --> gateway 0.0.0.0 --> device wan1

And finally i created a policy to allow all outgoing traffic from 192.168.100.254/24 to the wan interface.

My setup is:

Fortigate 40c
TP link sg108 (which holds the VLAN IDs)
Intel NUC with ESX 6.5 (where I created the port groups based on the VLAN IDs)

When I connect one of my VMs to one the newly created interfaces I can't get anything to work.


Any thoughts?
 
#1

7 Replies Related Threads

    Iescudero
    Silver Member
    • Total Posts : 103
    • Scores: 8
    • Reward points: 0
    • Joined: 2015/01/21 13:34:23
    • Location: Buenos Aires, Argentina
    • Status: offline
    Re: Multiple virtual interfaces 2018/08/07 05:11:15 (permalink)
    5 (1)
    Hi there!
    maybe is a dumb comment, but can you double check your route?
    It should look something like this:
     
    configure routing static
    edit 1
    set gateway 172.100.20.5
    set device wan1
    set dst 0.0.0.0
    next
    end
     
    And then, what I would do is this:
     
    1) Check in your internal interface if you any traffic with this:
    diagnose sniffer packet internal
     
    If you see a packet like this: 
    0.553565 802.1Q vlan#100 P0
    1.553430 802.1Q vlan#100P0
    That would mean that your Switch and VM host configuration is right, otherwise is not, so you will have to check that.
     
    2) Assuming that you saw packets with the VLAN tag, now you have to do is analysis that traffic, for instance you can do a ping to a google DNS from a host in VLAN 100:
     
    diagnose sniffer packet myvlan interface "host 192.168.100.10 and icmp"
    0.822234 192.168.100.10 -> 8.8.8.8: icmp: echo request
     
    3) Finally, you can debug this traffic to see what's going on:
    diagnose debug flow filter saddr 192.168.100.10
    diagnose debug flow filter daddr 8.8.8.8
    diagnose debug flow filter proto 1
    diagnose debug flow show console enable
    diagnose debug flow trace start 100
    diagnose debug enable
     
    Then you should look the output and check if you see something like this:
    "iprope_in_check() check failed, drop"  or "Denied by forward policy check"  or "reverse path check fail, drop"
     
    Hope it helps!
    #2
    sw2090
    Gold Member
    • Total Posts : 202
    • Scores: 10
    • Reward points: 0
    • Joined: 2017/06/14 01:27:25
    • Location: Regensburg
    • Status: offline
    Re: Multiple virtual interfaces 2018/08/07 06:10:45 (permalink)
    0
    Probably you have a mistake in your policy (If you set it like you wrote here).
    You have to allow the traffc from the whole subnet 192.168.100.0/24
    Routes have to be for the net too.
     
    #3
    J.One
    New Member
    • Total Posts : 4
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/08/07 00:23:39
    • Status: offline
    Re: Multiple virtual interfaces 2018/08/08 10:47:44 (permalink)
    0
    Hello guys, apologies for the late reply.
     
    I tried/checked all of the above (re-entered the route), but i don't see any traffic from VLANs 200 when I enter 'diagnose sniffer packet internal'.
    And I'm pretty sure the VLANs are correct because is basically the same setup as before, just a few extra VLANs.









     
    #4
    sw2090
    Gold Member
    • Total Posts : 202
    • Scores: 10
    • Reward points: 0
    • Joined: 2017/06/14 01:27:25
    • Location: Regensburg
    • Status: offline
    Re: Multiple virtual interfaces 2018/08/08 23:43:43 (permalink)
    5 (1)
    coud you additionally post a screenshot of your FGT's routing table? 
     
    What I see is you have a vlan and a policy for internet access via dnat. This is good so far.
    You one Screen (Switch) shows port 2 is just tagged in vlan 200. Basically this would mean that the device connected to that port on that switch must do the vlan tagging for tagged means the switch won't touch it.
    What I miss is that there is only ONE port tagged in vlan200. It has to be at least two because the port your client is connected must be in that vlan and also the port that goes to your FGT has to be tagged there. And if there is more swiches between this and the FGT the whole "way" has to be tagged then. Otherwise there would not be vlan transport between FGT and Client...
    #5
    J.One
    New Member
    • Total Posts : 4
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/08/07 00:23:39
    • Status: offline
    Re: Multiple virtual interfaces 2018/08/09 10:52:51 (permalink)
    0
    Here is  a screenshot of my routing table:

     
    As you point out, port 2 is the only port carrying the VLAN tags, and this is correct because port 2 is where my NUC (with ESXi) is connected to. And this is where the VLAN tags are divived into seperate virtual adaptors within ESXi (based on the VLAN tags), and this is where I need the VLANs, on my Virtual Machines. Al the physical devices are untagged on all of the other switch ports.
     
     
    #6
    emnoc
    Expert Member
    • Total Posts : 5020
    • Scores: 308
    • Reward points: 0
    • Joined: 2008/03/20 13:30:33
    • Location: AUSTIN TX AREA
    • Status: offline
    Re: Multiple virtual interfaces 2018/08/09 11:18:44 (permalink)
    5 (1)
    You need to do what lescudero  suggested and I would look at the firewall local arp table for that interface 
     
    diag ip arp list 
     
    if you have no  entries for the 192.168.100.xxx than fix your network/switching. Can you ping the  next-hop gateway from the client machines ( you need to allowaccess ping  on the interface )
     
    Ken
     
     

    PCNSE,  NSE , Forcepoint ,  StrongSwan Specialist
    #7
    J.One
    New Member
    • Total Posts : 4
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/08/07 00:23:39
    • Status: offline
    Re: Multiple virtual interfaces 2018/08/09 12:32:16 (permalink)
    0
    Finally, its working!
    Turns out I made two mistakes:
    1) I didn't set the VLAN tags on the physical port my Fortigate was connected to (I know, floolish of me...)
    2) I didn't enable ping on my DMZ interface (which I was trying to ping all the time...)
     
    Big thanks to all of you! You helped me a lot! 
    #8
    Jump to:
    © 2018 APG vNext Commercial Version 5.5