0

I have a Cisco managed switch which I have configured VLAN 2 to separate some networks. The main LAN is 10.3.7.0 and VLAN 2 is 10.3.9.0, with .1 being the default gateway. That VLAN is broken out of the LAN subnet on the Fortigate 200D firewall.

Now, I have a new LAN circuit I wish to connect. I want it to be able to communicate to the VLAN 2 subnet, and also out to the internet and to the LAN. I have tried plugging it into the firewall LAN ports and cannot access across the VLAN.

Currently the VLAN 2 DOES have access out to the internet. Do I need to plug this new network into the switch and configure it with VLAN 2 tagging as well to get it into the VLAN 2 subnet? If I do this, how do I give it access to the LAN?

Here is a picture of the VLAN config on the switch: http://prntscr.com/kuwrbq

I tried changing port 24 to 1UP,2T and I still do not have access.

  • Which port of the switch is the firewall connected to? – Aossey Sep 16 '18 at 5:17
  • Port 28 goes to port 1 on the Fortinet, which is LAN with VLAN sub nested under it. – ChristopherDill Sep 16 '18 at 18:18
0

Most likely there no access control list in the firewall to allow traffics from VLAN 2 and VLAN 2 to be passed between the subnets.

Since a device connected to an access port of the switch in VLAN 2, like GE24, can reach the internet we know that the default gateway address has been configured on the firewall. Any device on VLAN 2 that is trying to reach VLAN 1 is going to use VLAN2’s default gateway, just like when it is trying to reach the internet. Since we know the firewall is aware of VLAN 1 as well, this means that when there is a policy issue that is not allowing the traffic to get from VLAN 2 to VLAN 1, or back from VLAN 1 to VLAN 2 when the device on VLAN 1 tries to respond.

You should be able to confirm this by watching for dropped packets in the firewall management interface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.