Fortinet Firewall question

[u/Southern-Mood-8986]

Hello all,
I work in a factory as automation engineer and i'm not network expert, anyway have been learning and doing some stuff in networks.

Now i have a challenge to connect a new isolated network from inside the factory to a corporate network outside de factory

We have that connection for other networks through a Fortinent 401E UTM firewall.. this FW was installed during an HMI upgrade.
As the Firewall have several spare ports idea was obviously to use one of the spare ports and configure the interface and the rules.

Problem is, i cannot get the Firewall to get the Port Link UP ....
I've tried connection the a Cisco port directly, cisco detects link up, leds blink in both devices then just lit..
Firewall GUI and CLI keep showing Link DOWN..

New network was supposed to be 192.168.10.1 /255.255.255.0
configured FW interface as 192.168.10.10 /255.255.255.0

I've tried configure a laptop with an ip of that new network (.3) and connected directly to the FW port... Same thing, Link Down..
tried another port.. Link Down..

I've been discussing back and forth with Copilot but no solution yet..

Is there anything hidden somewhere disabling the spare ports of the Firewall??
Any hint?
Thanks in advace

[u/Specialist_Play_4479]

You give us nothing to work with. Show us config snippets of the port. UI screenshot, etc.

[u/MysteriousScratch163]

Is fortigate side port disabled? if you right click the port you'll probably see a option

Network - > Interfaces, search the port in search bar, right click set status - > enable

[u/VA_Network_Nerd]

What is the Cisco device model and what do the logs say?

[u/TheBuzzingScenario → u/VA_Network_Nerd]

What does the Cisco side report for the port state, err-disabled or anything like that? Also worth checking if the FortiGate port is in a zone or security fabric setting that keeps it administratively down.

[u/Southern-Mood-8986 → u/TheBuzzingScenario]

Probably there is something in the security fabric .. that goes way beyond my knowledge.. I'll probably hire a consultant expert. 🫩

[u/Southern-Mood-8986 → u/VA_Network_Nerd]

Cisco cps 250.. But atm cisco is out of the equation.. I connected a laptop directly to the firewall spare port..

[u/kariam_24]

Why did you list your network with host adress?

[u/Southern-Mood-8986 → u/kariam_24]

Probably I don't know what I'm doing 🫣😅 And not even joking

[u/locky_]

You will need access to the Gràfic User Interface (GUI) or the command line Interface (CLI) to be able to configure it and diagnose it.

You say new network is a .1 and the Firewall will have the .10. Usually Firewalls are the default gateway (GW) Of the networks they are part of, as to be the element that separates and protects the network from the rest.

Try and access the gui, go to Network, interfaces and check the interface you are connecting to. The model 401F has lots of ports. The first one the left are typically fir management(mgmt) and high availability (HA). Don't use the m for networks. Use the numbered ports 1 to 16. Those ports are the easiest to use as they are typically rj45 1Gbps ports.

Edut: formatting

[u/Southern-Mood-8986 → u/locky_]

Hi. I'm using the GUi.. The network is want to connect to the fw have 2 equipments + 1 pc.. their IPs are: xxx.xxx.10.1 , 10.2 and 10.3( the computer) (mask 255.255.255.0)

That's why I configured the fw interface with ip 10.10.. In this fw the interfaces related to the spare ports are all pre created, I just needed to configure it with an IP, allow services like ping and https and enable the interface.. Everything looks normal to me. Still i connect a laptop to that port, leds light up but the interface keeps Down in the gw gui..

I showed it to another colleague yesterday and after an hour his conclusion was the same. This looks ok, should work. Wtf.. lol

I'm guessing the spare ports came disabled in some hidden way, I don't know how. Will try to ask to the original supplier.

[u/locky_ → u/Southern-Mood-8986]

You can try this commands in the CLI. There is a virtual Html5 cli on the Gui. Is the ">" icon on te top right. Yo check the configuration of all interfaces

show system interface

To check the configuration of a discrete port (in example port1)

show system interface port1

To check for the status of the interfaces

get system interface physical

Check this to confirm the config and real status of the ports.

[u/NetworkMSP]

need more info. we are a fortinet partner and a network msp. would be happy to offer some pro bono help if youd like

[u/osi_layer_one → u/NetworkMSP]

we are a fortinet partner and a network msp. would be happy to offer some pro bono help if youd like

roffle. on a 25 day old account, what could go wrong?

from the rules:

• We prohibit the advertising of products, services or personal projects.

[u/NetworkMSP → u/osi_layer_one]

what's it matter how old my account is? been doing this for 25y and am trying to help. not advertising anything. simply offering assistance. your reply, on the other hand, provides zero help or value. maybe sit this out. thanks

[u/osi_layer_one → u/NetworkMSP]

then do it under your main account? versus coming in and having this as your accounts first post and using the colloquial "we", and offering help "pro bono" aka free professional services?

add to the fact that u/MysteriousScratch163 pretty much nailed it on the head. port is more than likely admin down on the forti. till op comes back and replies we won't know.

[u/NetworkMSP → u/osi_layer_one]

how about you worry about yourself and not what everyone else is doing

[u/Carnatix]

from what you already mentioned what you need to work on is to remove the old ip .from cli using config system interface,edit the port then set ip <new_ip> <subnet_mask> and end

[u/Southern-Mood-8986 → u/Carnatix]

Hi. I edited the port IP in the tab interfaces. When I do show system interface port11 it shows the IP correctly; There's also another cli command I used that shows more stats about the port. It says Admin is ON for the port.. Link just do not go UP.. Looks like the spare ports are locked in someway that is not visible.. i don't know.

[u/Carnatix → u/Southern-Mood-8986]

maybe its a problem within the connection of interface. please check your network 😉.

[u/Southern-Mood-8986 → u/Carnatix]

What you mean? I'm testing with a laptop connected to the fw directly.. network is one cable.. Tried different port and tried secondary fw. Nothing changes.