Fortigate and Fortiswitch - Vlans

[kkriss81]

Hi all.

I have a problem to proper configure FG and FS.

I have

iternet modem

   |

   | (vlan100)

   |

switch (cisco)

   |

   |(vlan100)

   |

switch (fortiswitch)

  |

  |(vlan100)

  |

fortigate

When I use Cisco SG-300 (instead Fortiswitch), and configure port to untagged vlan 100 every things works ok.

But when i change to Fortiswitch native vlan 100, thats not working.

I have fortilink beetwen FG(port7) and FS(port48).

Trunk beetween FS and Cisco SW works ok.

I use port 6(vlan100) on FS and port WAN1 on FG.

Vlan 1 is working ok, beetween FG(port1) and FS(port1).

What can be wrong?

FG v. 6.0.4

FS v. 6.0.2

FS managed from FG.

[gradius85]

Can you show the cisco config? Remember Cisco has different meaning for Untag Native vlan VS Access port. You can have untagged traffic going over your trunk port, which is not tagged; however, I am not fully understanding your issue, but I would like to help.

When you say "remove switch for cisco" does that mean you remove the Fortigate switch that is behind the Cisco switch?

Please sent the Cisco config of the switch ports you are using.

[kkriss81]

Thanks for replay.

gradius85 wrote:

When you say "remove switch for cisco" does that mean you remove the Fortigate switch that is behind the Cisco switch?

Now i have -> modem - cisco(sw) - cisco(sw) - Fortigate. I want change the cisco switch (connected to fortigte) to fortiswitch.

Cisco port configuration where all is ok

"interface gigabitethernet45

description "uplink vlan 100" switchport trunk native vlan 100 !"

Fortiswitch conf for this port

edit "port6" set native-vlan 100 set igmp-snooping disable set snmp-index 6 next

[gradius85]

Do you need the 'trunk native vlan 100'? Can you get away with just an Access Port? Or do you have a need to see/tag all traffic except v100 traffic?

[kkriss81]

it must be in vlan 100. It can be in access port in vlan100, but when I change Vlan100 in FG to access it also does not working.

I have read somewhere

"You must configure the proxy ARP with the config system proxy-arp CLI command to be able to use the access VLANs. "

But i really don't understand why i need to do it.

In cisco switch all working, but in FS not.

[gradius85]

Proxy ARP...That seems very odd, since you do not need the device to answer the ARP, since you are not using it for routing. However, maybe the  Fortigate needs to ARP for the Modem, so the firewall interface is getting your public IP assigned.

Is your modem a cable modem, and are you trying to apply the IP on the WAN side of the Fortigate firewall?

[kkriss81]

Is the router witch has own ip address x.x.x.33, FG on WAN1 has x.x.x.34

On cisco switch all works ok.

I have notice one more error, when Wan1 FG is connected to port6 on Fortiswitch, all network are terrible low.

So with configuration FS is something bad. 

[gradius85]

When you say vlan from your "internet modem" - is the Modem tagging the traffic with vlan100 802.1q tags? Or are you just showing that you want that traffic to be part of vlan100?