Allowing all subnets

[PatGCash]

I have a Fortigate 60E and I'm setting up most of this in the WebGUI. I'm trying to set up several subnets on one port and allow all of them to talk to each other. 

I do have port 1 configured so

# sh sys int internal config system interface edit "internal" set vdom "root" set ip 10.10.0.3 255.255.255.0 set allowaccess ping https ssh snmp http fgfm capwap set type hard-switch set alias "nonpci1-switch" set device-identification enable set role lan set snmp-index 5 set secondary-IP enable config secondaryip edit 1 set ip 10.10.8.1 255.255.255.0 set allowaccess ping next edit 2 set ip 10.10.3.1 255.255.255.0 set allowaccess ping next edit 3 set ip 10.10.5.1 255.255.255.0 set allowaccess ping next edit 4 set ip 10.10.4.1 255.255.255.0 set allowaccess ping next edit 5 set ip 10.10.7.1 255.255.255.0 set allowaccess ping next end next end

---I did set up a IPv4 Policy

# show firewall policy config firewall policy edit 1 set name "CASHLAN" set srcintf "internal" set dstintf "internal" set srcaddr "all" set dstaddr "all" set action accept set status enable set schedule "always" set service "ALL" next end

What else do I need to do? I did see something about Policy Routes but that does not show up for me.

[Toshi_Esumi]

Is not working? I don't know how all devices are connected to the 60E physically, I don't see anything particularly it wouldn't work. As you're aware of this might not be so efficient since all subnets are sharing the same broadcast domain though. I would rather either separate those "internal" ports and assign individual subnet on "internal1", "internal2", and so on, or set them in different vlan subinterfaces and let them spread through a switch(es).

[PatGCash]

I was off by one number on something and now it works. My trouble with VLANs is that we have a server that has an IP on one subnet and then a VIP on another subnet and then admin of the server doesn't want to tag them with VLAN IDs. It would make my world a lot simpler if he did. 

[kingpin]

sir working your vlan in ordinary switch???? 

[sw2090]

hm that should grant access from all subnets to all subnets on the switch.

Thus you will get into trouble with that once you want internet access too ;)