Hot!Routing between 2 subnets is it possible with a 300D

Author
jcm05
New Member
  • Total Posts : 14
  • Scores: 0
  • Reward points: 0
  • Joined: 2016/07/01 07:51:13
  • Status: offline
2019/05/10 11:58:12 (permalink)
0

Routing between 2 subnets is it possible with a 300D

So I currently have a switch with IP 172.16.0.1/21 connect to Fortigate Lan port 2 172.16.0.220/21 and want to add a new subnet with a new switch IP 172.18.0.1/21 connected to Fortigate Lan port 3 172.18.0.220/21. Once connected they show up in the Router Monitor but I want to be able to communicate ping or other wise say from the old subnet to a computer/server on the new subnet. I added a rule that said all traffic from one lan interface to another with all servers and no NAT but still cannot get them to communicate past either switch. Spoke to the switch manufacture and they said all information on the switch is correct and both switches can ping the lan ports on the firewall just nothing passed so they said to contact fortigate. I called and spoke to a rep and the told me that routeing between two subnets on two different interfaces is not possible is that true.
#1

7 Replies Related Threads

    Dave Hall
    Expert Member
    • Total Posts : 1477
    • Scores: 163
    • Reward points: 0
    • Joined: 2012/05/11 07:55:58
    • Location: Canada
    • Status: offline
    Re: Routing between 2 subnets is it possible with a 300D 2019/05/10 12:38:36 (permalink)
    0
    L2 switches themselves do not route traffic by IP, so putting an IP on a switch would be for management purposes only IMO.  Communication between the Fortigate and the switchers should be via the trunk or uplink ports on the switches.  Default routes for each subnet should be to the Fortigate (172.x.0.220) and not the switch (172.x.0.1).
     
    So in the routing table, you should see something like:
    Network            gateway                          Interface
    172.16.0.0     172.16.0.220  (or 0.0.0.0)     port2
    172.18.0.0     172.18.0.220   (or 0.0.0.0)    port3

    Someone correct me if this is not correct.
    post edited by Dave Hall - 2019/05/10 13:03:15

    NSE4/FMG-VM64/FortiAnalyzer-VM/5.4/6.0 (FWF40C/FW92D/FGT200D/FGT101E)/ FAP220B/221C
    #2
    Toshi Esumi
    Expert Member
    • Total Posts : 1650
    • Scores: 139
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: Routing between 2 subnets is it possible with a 300D 2019/05/10 13:16:42 (permalink)
    0
    The problem is all of the IPs above are in a big 172.16.0.0/21 (up to 172.23.x.x) subnet. They're NOT different subnets. That's why the rep said it's impossible. If they're /24s, yes, it's possible.
    #3
    Toshi Esumi
    Expert Member
    • Total Posts : 1650
    • Scores: 139
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: Routing between 2 subnets is it possible with a 300D 2019/05/10 13:18:38 (permalink)
    0
    s**** my comment. I was not thinking straight...sorry.
    #4
    ede_pfau
    Expert Member
    • Total Posts : 6050
    • Scores: 480
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: Routing between 2 subnets is it possible with a 300D 2019/05/11 05:23:35 (permalink)
    0
    If your policy is correct (you need two!) then it's due to incorrect routing.
     
    Make sure your hosts have got the correct default route, like @Dave Hall has posted: one part of your hosts is in the 172.16 subnet, the other in the 172.18 subnet. Their IP config must have a default route of 172.16.0.220 and 172.18.0.220, respectively. The easiest way to make that happen is to configure DHCP servers on both ports and select "gateway: use interface address" in the setup.

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    #5
    jcm05
    New Member
    • Total Posts : 14
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/07/01 07:51:13
    • Status: offline
    Re: Routing between 2 subnets is it possible with a 300D 2019/05/12 11:24:24 (permalink)
    0
    So both switches are the default gateways on there subnet and both have a default route to there corresponding Fortigate interface. Switch 172.16.0.1 has a default route of 0.0.0.0 172.16.0.220 and switch 172.18.0.1 default 0.0.0.0 172.18.0.220. So if I execute a ping from switch 172.16.0.1 I can ping both interfaces 172.16.0.220 and 172.18.0.220 as well as switch 172.18.0.1 but nothing connected to switch 18. If I ping from the other switch 172.18.0.1 I can ping anything on the subnet of 172.16.0.0/21 but if I go to a computer on 172.18.0.0/21 I cannot ping anything on 172.16.0.0/21
    #6
    sw2090
    Gold Member
    • Total Posts : 397
    • Scores: 21
    • Reward points: 0
    • Joined: 2017/06/14 01:27:25
    • Location: Regensburg
    • Status: offline
    Re: Routing between 2 subnets is it possible with a 300D 2019/05/12 23:39:07 (permalink)
    0
    You did not understand! A Laywer 2 Switch can not be your default gateway for your subne for - as said before - they can not do any routing. Your Clients have to use the Fortigate with its corresponding LAN address als default Gateway.
    On the FGt you have already done the routing by creating the interfaces. 
    You just have to have policies to allow the traffic.
     
     
    #7
    jcm05
    New Member
    • Total Posts : 14
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/07/01 07:51:13
    • Status: offline
    Re: Routing between 2 subnets is it possible with a 300D 2019/05/14 05:44:31 (permalink)
    0
    SW2090 you jogged my memory thanks. I had it in my notes to change dhcp and static address to the .200 lan interface for the gateways. The switches had been the default gateways for many years basically forwarding traffic on the subnet then when it feel out of range sending up to the default route which was a Microsoft TMG firewall. Once I replaced the Fortinet I planned on redoing the gateway proper but was on Medicaal leave and forgot I had wrote and pllaned all this out. Anyways changing the gateways did correct the issues now need to go correct change all other old gateways to confirm. Thanks again Fourm.
    #8
    Jump to:
    © 2019 APG vNext Commercial Version 5.5