AnsweredHot!Transit vlan

Author
......mih.ai......
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/04/23 01:29:10
  • Status: offline
2019/04/23 02:26:59 (permalink) 5.4
0

Transit vlan

Hello.
sorry for my bad english.
I have fortigate 200d and i need set up transit vlan
I move virtual server from my network to provider, and he can't give me l2 network, only trasnit l3
Now i need set up transit vlan where i route my vlan, and i don't understand how i must create it.
Cable from provider plug in physical interface on fortigate, i set ip of transit vlan on it and create vlan with tag.
see attach
 
 
post edited by ......mih.ai...... - 2019/04/23 07:55:22

Attached Image(s)

#1
Toshi Esumi
Expert Member
  • Total Posts : 1622
  • Scores: 137
  • Reward points: 0
  • Joined: 2014/11/06 09:56:42
  • Status: offline
Re: Transit vlan 2019/04/23 09:19:37 (permalink)
0
The diagram tell a thousand words. Very simple. Create a vlan interface with vlanid 901 under the physical interface then put 10.3.198.10/24 on the vlan interface. You obviously need proper static routes to reach those 5 subnets.
#2
......mih.ai......
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/04/23 01:29:10
  • Status: offline
Re: Transit vlan 2019/04/23 09:39:19 (permalink)
0
When i create vlan 901 under physical interface, i can't ping provider gate 10.3.198.1.
When i try set up gate for static route i write 10.3.198.10 and it's fail, i can't use ip address which choosen for ip adress on physical interface.
My provider tell me use 10.3.198.10 like gate for me
post edited by ......mih.ai...... - 2019/04/23 09:54:25
#3
Toshi Esumi
Expert Member
  • Total Posts : 1622
  • Scores: 137
  • Reward points: 0
  • Joined: 2014/11/06 09:56:42
  • Status: offline
Re: Transit vlan 2019/04/23 10:00:38 (permalink)
0
Leave IP area blank on the physical/parent interface. That's a non-tagged interface. Then you should sniff traffic on the vlan 901 interface (diag sniffer packet VLAN_INTERFACE_NAME) to get any clue for what's going on.
post edited by Mod_FTNT - 2019/04/28 19:47:28
#4
sw2090
Gold Member
  • Total Posts : 369
  • Scores: 21
  • Reward points: 0
  • Joined: 2017/06/14 01:27:25
  • Location: Regensburg
  • Status: offline
Re: Transit vlan 2019/04/24 01:17:36 (permalink)
0
that is correct so far because you already have an interface in that network. Just the ip must not be on the physical interface but on the vlan 901 interface!
As you have an Interface in that Network you don't need a static route because the interface already knows the routing for that subnet.
What you have to have - like said some posting above - is static routes for the 10.3.10x.0/29 subnets. And these have to have the vlan interface as interface and 10.3.198.10 as Gateway.
Additionally you still will have to set up policies to allow traffic from mynetowrks to 10.3.10x.0/29.
#5
......mih.ai......
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/04/23 01:29:10
  • Status: offline
Re: Transit vlan 2019/04/24 03:24:14 (permalink)
0
I ask provider which type of port he use, it was access, he change type of port to trunk.
I create interface under physical and now i can ping him gate 10.3.198.1
But static route doesn't work.
I exec "diag sniffer packet" 
see attach all in one.

Attached Image(s)

#6
sw2090
Gold Member
  • Total Posts : 369
  • Scores: 21
  • Reward points: 0
  • Joined: 2017/06/14 01:27:25
  • Location: Regensburg
  • Status: offline
Re: Transit vlan 2019/04/24 04:06:10 (permalink)
0
as I said: you dont need a static route for 10.3.198.0/24 since there is an interface in that subnet on your FortiGate. 
You do need static routes for 10.3.100.0/29, 10.3.101.0/29,10.3.102.0/29,10.3.107.0/29 and 10.3.110.0/29 with 10.3.198.1 as Gateway and the vlan 901 interface as interface.
 
And then you need Policies to allow traffic from your networks via your FGT and the transit vlan to those subnets mentioned above.
 
#7
......mih.ai......
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/04/23 01:29:10
  • Status: offline
Re: Transit vlan 2019/04/26 07:55:24 (permalink)
0
yes it's my fall that i use wrong gate, now i set 10.3.198.1
I found problem in routing:
Routing entry for 10.3.107.0/29
  Known via "static", distance 10, metric 0
    10.3.198.1, via transit vlan
Routing entry for 10.3.107.0/29
 Known via "connected", distance 0, metric 0, best
  * is directly connected, VLAN107
 
How i can change best routing for vlan107?
I try change distance and set priority, but it doesn't work.
I don't use route-map
#8
sw2090
Gold Member
  • Total Posts : 369
  • Scores: 21
  • Reward points: 0
  • Joined: 2017/06/14 01:27:25
  • Location: Regensburg
  • Status: offline
Re: Transit vlan 2019/04/28 23:09:22 (permalink)
0
hmm...what is the Interface "connected"?
Do you have a misconfigured interface?
Alas you could change die Priority/Distance of your route but you cannot influnence routes that come automagically like net routes over physical or vlan interfaces....
You must not have configured any interface for 10.3.107.0/29 on your FGT. You should only have a static route and at least one policy to allow the traffic.
#9
......mih.ai......
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/04/23 01:29:10
  • Status: offline
Re: Transit vlan 2019/04/29 03:12:23 (permalink)
0
Hello
I create vlan under physical interface see attach in post 6.
Before i don't understand how create traffic policy rules without interface for 10.3.107.0
But now I understand how I should have been created interface and rules.
 
If port access on provider side set on physical adapter set ip 10.3.198.10, if trunk to under physical adapter create vlan 901 with ip 10.3.198.10
create static route for 10.3.107.0 with gate 10.3.198.1
create Address for 10.3.107.0/29
Create ip4v policy from provider to lan1: 
Incoming Interface  transit vlan 
Outgoing Interface lan1
Source 10.3.107.0 
Destination all
 
 
Thanks all
#10
sw2090
Gold Member
  • Total Posts : 369
  • Scores: 21
  • Reward points: 0
  • Joined: 2017/06/14 01:27:25
  • Location: Regensburg
  • Status: offline
Re: Transit vlan 2019/04/29 04:56:07 (permalink) ☼ Best Answerby ......mih.ai...... 2019/04/29 07:23:11
5 (1)
you have to have
 
- one vlan interface that has vid of the transit vlan and is usually bend to a physical interface. You already have that.
- a static route for the subnet you want to reach over the vlan ith your providers gateway as gateway.
- at least one policy to allow the traffic. This has the transit vlan interface as source interface and the remote subnet as destination. Incoming interface is the interface you are on and source is the subnet you come from.
#11
......mih.ai......
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/04/23 01:29:10
  • Status: offline
Re: Transit vlan 2019/04/29 05:02:14 (permalink)
0
If you wrote this in first post:)
#12
sw2090
Gold Member
  • Total Posts : 369
  • Scores: 21
  • Reward points: 0
  • Joined: 2017/06/14 01:27:25
  • Location: Regensburg
  • Status: offline
Re: Transit vlan 2019/04/29 05:35:07 (permalink)
0
yeah didn't see that in the notification mail and sometimes the form doesn't quote the original msg anywhere  when you Reply...
yes you basically wrote that in your post above mine. 
So does it work now?
#13
......mih.ai......
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/04/23 01:29:10
  • Status: offline
Re: Transit vlan 2019/04/29 07:23:02 (permalink)
0
yes, all works
#14
Jump to:
© 2019 APG vNext Commercial Version 5.5