Skip to main content
p0lak13
p0lak13
New Member
October 29, 2014
Question

Basic ping through DMZ

  • October 29, 2014
  • 3 replies
  • 10749 views

Hello everybody !

 

I Need some Help on a Fortigate 60D. I Have to learn how it works to sell it later.

Here's my problem :

 

I have connected the wan1 port, on my DMZ network and I acces it with a SSH Tunnel.

The DMZ network look like 192.168.4.0/24.

 

The gateway is 192.168.4.1 (which is a cisco firewall)-- I Tried to connect a computer instead of the fortigate, on the DMZ, I set a static IP with the gateway and I was able to ping 8.8.8.8.

 

When I set a static IP like 192.168.4.123 on my fortigate's wan1 port, with the correct  gateway, everything looks fine.

But, I'm unable to ping internet. I'm able to ping all the computers in DMZ (like 19.2168.4.19 or my gateway 192.168.4.1) but I'm unable to ping 8.8.8.8.

 

I don't understand why :( Before configuring  the network interface, I reseted the fortigate.

So my actual configuration is  :

 

wan1 interface :

ip 192.168.4.123

netmask : /24

gateway : 192.168.4.1

 

 

default gateway for wan1 : 192.168.4.1

 

The ping doesn't work. On a computer with the same configuration it works.

 

Is there a parameter to set to make my ping work ? Where am I doing a mistake ?

 

Thank you :)

    3 replies

    emnoc
    emnoc
    New Member
    October 29, 2014

    Let me play dumb here;

     

    Your gateway is another firewall?

     

    You can ping that firewall ( assuming they respond to pings request ) ?

     

    Are you 100% sure the firewall is allowing pings? and from your address ?

     

    Does the cisco have allow or using NAT controls to allow your .123 address thru?

     

    Can you conduct a  trace execute  trace  8.8.8.8 ( once again assuming the cisco firewall allows traceroutes )

     

    And are you 100% sure your default is using the right interface ?

     

    Basically you need to look at the cisco.

     

    Ken

    p0lak13
    p0lak13Author
    New Member
    October 29, 2014

    Your gateway is another firewall?  --> Yes, my gateway is a Cisco ISA 550W Firewall (Cisco Small Business Solutions)

    You can ping that firewall ( assuming they respond to pings request ) ? --> I can ping this firewall on his DMZ interface (192.168.4.1) but not on his others interfaces (192.168.0.1 --> LAN interface, 109.2.X.X --> Public IP)   Are you 100% sure the firewall is allowing pings? and from your address ? I am sure my firewall allow ping because I tried using the same address on the computer and the fortigate, and I'am able to ping with the computer but not with the fortigate(with the same IP address)   Does the cisco have allow or using NAT controls to allow your .123 address thru? --> Didn't understand this :/   Can you conduct a  trace execute  trace  8.8.8.8 ( once again assuming the cisco firewall allows traceroutes )  --> The tracert give the following result from the fortunate :

     

    Note : The cisco allows trace route.

    And are you 100% sure your default is using the right interface ? --> To be sure, I setup only my wan1 interface and I administratively shutdown the others interface of the fortigate, so I'm sure my default is using the right interface.

     

    Miracle !! I don't know what I did, but the ping and the tracer work properly for 8.8.8.8.

     

    Maybe a NAT rule that takes time to act.

    Thanks for your help.

    emnoc
    emnoc
    New Member
    October 30, 2014

    When I set a static IP like 192.168.4.123 on my fortigate's wan1 port, with the correct  gateway, everything looks fine.

     

     

    I bet you had a 2nd default route out one of the other interfaces and hence why things where broke, but either way it worked out for you.

    Terms & ConditionsAccessibility statement