AnsweredHot!Traffic between VLAN and interface

Author
ITadm
Bronze Member
  • Total Posts : 23
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/08/28 08:37:03
  • Status: offline
2019/03/08 10:27:56 (permalink)
0

Traffic between VLAN and interface

Hello, 
 I have some difficulties with sending traffic between an interface and VLAN:
 
Physical interface:   12.155.16.128 / 255.255.255.192
VLAN:                    12.155.16.192 / 255.255.255.192
 
I created IPv4 policies between them, normally with just VLANs it works fine, but not really between an interface and a VLAN. I tried to switch on and off NAT in these policies, but with no luck. 
 
Funny thing is that I have a site-to-site VPN tunnel connected to this location and I can reach hosts on this physical interface and VLAN just fine.
 
Thank you for your help in advance!
post edited by ITadm - 2019/03/08 12:06:48
#1
Toshi Esumi
Expert Member
  • Total Posts : 1378
  • Scores: 113
  • Reward points: 0
  • Joined: 2014/11/06 09:56:42
  • Status: offline
Re: Traffic between VLAN and interface 2019/03/08 11:30:37 (permalink)
0
How do they show up in the routing table when you do "get router info routing-t all"?  Like below? Then you must have two policies between two interfaces for both directions.
C       12.155.16.128/26 is directly connected, <INTERFACE_NAME>
C       12.155.16.192/26 is directly connected, <VLAN_NAME>
And what is the version of your FortiOS?
 
#2
ITadm
Bronze Member
  • Total Posts : 23
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/08/28 08:37:03
  • Status: offline
Re: Traffic between VLAN and interface 2019/03/08 11:51:35 (permalink)
0
I already created policies for both directions, that was actually the first thing I did, beacuse it's what I do when I want to connect VLANs :).
 
Routing table:
Routing table for VRF=0
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
       O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default
 
S*      0.0.0.0/0 [10/0] via xx.xx.xxx.xxx, wan
S       99.15.124.0/24 [10/0] is directly connected, S2S-DDS-DC
S       10.10.0.0/16 [3/0] is directly connected, RC_DC
C       10.10.5.64/27 is directly connected, LAN-Group
C       10.10.5.96/27 is directly connected, LAN-Guest
C       10.10.5.160/27 is directly connected, lan3
C       12.155.16.0/27 is directly connected, LAN-Systems
C       12.155.16.64/26 is directly connected, lan1
C       12.155.16.128/26 is directly connected, lan2
C       12.155.16.192/26 is directly connected, LAN-PC
C       xxx.xxx.xxx.xxx/xx is directly connected, wan
S       192.168.0.0/16 [3/0] is directly connected, RC_DC
 
I have the latest FortiOS v6.0.4 build0231 (GA) and I forgot to mention that it's a Fortigate 30E.
Thanks for your response!
#3
Toshi Esumi
Expert Member
  • Total Posts : 1378
  • Scores: 113
  • Reward points: 0
  • Joined: 2014/11/06 09:56:42
  • Status: offline
Re: Traffic between VLAN and interface 2019/03/08 13:17:59 (permalink)
0
Then I don't see any reason they can't communicate each others unless there is a bug. Do sniffing "diag sniffer packet any 'host SRC_OR_DST_IP' 4" first to make sure the packets are incoming but not going out anywhere else. Then run flow debugging (you can find how in the Forum, Cookbooks, KB, and online-help) to see why those are dropping. 
#4
ITadm
Bronze Member
  • Total Posts : 23
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/08/28 08:37:03
  • Status: offline
Re: Traffic between VLAN and interface 2019/03/08 13:58:11 (permalink)
0
Basically, the only packets other than the ones from a VPN tunnel are ARP:
 
.793669 LAN-PC in arp who-has 12.155.16.130 tell 12.155.16.202
36.795968 LAN-PC in arp who-has 12.155.16.130 tell 12.155.16.202
37.797733 LAN-PC in arp who-has 12.155.16.130 tell 12.155.16.202
38.793532 LAN-PC in arp who-has 12.155.16.130 tell 12.155.16.202
39.794031 LAN-PC in arp who-has 12.155.16.130 tell 12.155.16.202
40.797452 LAN-PC in arp who-has 12.155.16.130 tell 12.155.16.202
41.793612 LAN-PC in arp who-has 12.155.16.130 tell 12.155.16.202
 
It happens when I ping 12.155.16.130 from 12.155.16.202 and this is the result:
 
Reply from 12.155.16.202: Destination host unreachable.
 
I will run flow debugging, I hope it's not a bug
#5
Toshi Esumi
Expert Member
  • Total Posts : 1378
  • Scores: 113
  • Reward points: 0
  • Joined: 2014/11/06 09:56:42
  • Status: offline
Re: Traffic between VLAN and interface 2019/03/08 14:26:24 (permalink) ☼ Best Answerby ITadm 2019/03/09 09:10:24
5 (2)
The PC(?) you're pinging from has a wrong subnet mask, bigger than /26. .202 device shouldn't ask ARP request to .130, which is in the different subnet.
#6
ITadm
Bronze Member
  • Total Posts : 23
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/08/28 08:37:03
  • Status: offline
Re: Traffic between VLAN and interface 2019/03/09 01:01:57 (permalink)
0
They both have /26 subnet which is 255.255.255.192, because I wanted to cut 12.155.16.0 to 4 parts:
 
12.155.16.0/27
12.155.16.64/26
12.155.16.128/26
12.155.16.192/26
 
Why it's wrong?
#7
ede_pfau
Expert Member
  • Total Posts : 5830
  • Scores: 423
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
Re: Traffic between VLAN and interface 2019/03/09 02:26:24 (permalink)
0
Toshi says that he suspects the PC is misconfigured, not that the scheme itself is wrong.
If these were indeed two separate subnets then the PC wouldn't ARP for the target's MAC address but instead forward traffic to the router (= the FGT).
So, could you please check the settings on the PC?
 
BTW, there is nothing special with traffic between a physical and a virtual interface, not in FortiOS.

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#8
ITadm
Bronze Member
  • Total Posts : 23
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/08/28 08:37:03
  • Status: offline
Re: Traffic between VLAN and interface 2019/03/09 02:37:50 (permalink)
0
Ok, I get it, but there is not much I could have set wrong, interfaces look like this:
 
lan2 12.155.16.129 / 255.255.255.192
LAN-PC 12.155.16.193 / 255.255.255.192
 
I pasted my routing table in my 2nd post directly from CLI and it looks fine I think. What else can be wrong in this setup? I still didn't run flow debugging, I will paste it here soon
 
Ok, I don't know how I did it, but I had 255.255.255.128 in my DHCP settings in LAN-PC. Now it works like a charm, thank you!
post edited by ITadm - 2019/03/09 03:03:39
#9
ede_pfau
Expert Member
  • Total Posts : 5830
  • Scores: 423
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
Re: Traffic between VLAN and interface 2019/03/09 03:06:12 (permalink)
5 (1)
Good! Credits to @Toshi, pls.

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#10
Jump to:
© 2019 APG vNext Commercial Version 5.5