1

Longtime lurker, first-time poster here! Still learning networking so please be patient.

I’m currently reconfiguring some policies and settings on our FortiGate 80F. Recently, we transitioned from FortiGate APs to Unifi APs, which required setting up new VLANs to manage both the main WiFi and guest WiFi networks.

Here’s our current setup:

LAN: Configured on internal1 of the FortiGate with an IP/Netmask of 192.168.1.1/255.255.252.0.

Main WiFi (VLAN40): Assigned to VLAN40 with an IP/Netmask of 10.10.40.1/255.255.255.0.

Guest WiFi (VLAN50): Assigned to VLAN50 with an IP/Netmask of 10.10.50.1/255.255.255.0.

The Issue
Devices on the internal1 subnet are unable to ping devices on the main WiFi network (VLAN40), except for the VLAN gateway 10.10.40.1. However, devices on the main WiFi network can successfully ping and remote into any device on the internal1 subnet.

I’ve attached screenshots of the current firewall policies for traffic between internal1 and VLAN40 (main WiFi) in both directions.

Any guidance or suggestions on how to resolve this would be greatly appreciated!

vlan40
vlan40787×1132 48 KB

internal1
internal1793×1110 46.1 KB
2 Spice ups
2

I’d recommend setting the source and destination to match those VLAN addresses. And only allow the services you need across those subnets. This is how I configured the routing policies at my last job, which used FortiGate as well.

3

Nearly all operating systems would have a host firewall blocking ping.
e.g. if Windows device on Wifi have you tried disabling the windows firewall and re-testing.
aside from ping, do other services work - e.g. what are you trying to do from internal LAN to wifi device?
Not wanting to teach to suck eggs, but obvioulsy if vlan 40 is a new ip range then it needs adding to current infrastrucutre such as firewall rules, AD sites and services etc.
If a windows device encounters a new unknown IP range then it will assume it is public and aply the public firewall policy etc.

As these vlans are new presumably the routing is correct e.g. if simple the firewall is the default gateway for wifi devices and for internal lan devices?

Does the firewall log the attempts from internal lan 1 to Wifi as successful?