Thanks Dave for your reply, but now I am sure its FGT causing ARP "problem".
To simplify things my network topology is as follows:
FGT:internal1 <-----> Switch <-----> AP1 "ssid:RED"
FGT:internal2 <-----> AP2 "ssid:BLUE"
FGT reboot.
Connecting via AP1 ("RED") or Switch is OK. As long as I connect through Internal1 to FGT (doesn't matter if through AP1 or Switch) I get ip from DHCP server and ARP requests from PC are answered by FGT. Communication is OK.
Now, when at this point I connect to AP2 ("BLUE") or directly (via LAN) to Internal2, I get DHCP from FGT but ARP request from PC are not answered by FGT.
Now, rebootin FGT again and doing symmetrical thing, connecting to AP2 or directly to Internal2 just after FGT reboot, everything is OK. I can switch between AP2 or Internal2 access without issues. But trying to connect to AP1 or via Switch which are connected to Internal1, results in ARP issue (DHCP is ok, just ARPs are not answered by FGT).
So, there must be some feature at FGT that prevents ARP between Internal1 and Internal2, despite the fact, these ports serve the same network (same native VLAN), they are part of software switch.
Is this an issue? Or is this expected by desing? How change this behavior to have a "single" network served by both physical ports?
This is my port config:
config system interface
edit "internal1"
set vdom "root"
set type physical
set alias "phy-port1"
set role lan
set snmp-index 7
next
edit "internal2"
set vdom "root"
set type physical
set alias "phy-port2"
set role lan
set snmp-index 8
next
edit "vswitch_1"
set vdom "root"
set ip 192.168.0.1 255.255.255.0
set allowaccess ping https ssh
set type switch
set device-identification enable
set role lan
set snmp-index 9
next
edit "vlan_10"
set vdom "root"
set ip 192.168.10.1 255.255.255.0
set allowaccess ping https ssh
set role lan
set snmp-index 10
set interface "internal1"
set vlanid 10
next
edit "vlan_20"
set vdom "root"
set ip 192.168.20.1 255.255.255.0
set allowaccess ping https ssh
set role lan
set snmp-index 11
set interface "internal1"
set vlanid 20
next