Can't ping VLAN interfaces through VPN

Forum|Forum|2 years ago
April 27, 2024
3 replies
3227 views

Hello - I have 5 vlans configured on my FGT 60F. I am using SSL VPN. I have left the internal physical IP at 192.168.1.99. My VLAN interfaces are 10.235.20.1, ...30.1, ...40.1, ...60.1 and ...100.1.

I created a policy for inter-vlan routing. When I connect directly to my FGT, I can ping all VLAN interfaces and the physical interface. All good.

When I connect with Forticlient, I can ping the internal 192.168.1.99 phyiscal IP but I cannot ping any of the VLAN interfaces. I have nothing connected to the VLANs but I would have assumed I'd be able to ping the interfaces, especially since it's successful when I'm directly connected to the FGT. See below. Any thoughts?

Thanks,

Joel

Screenshot 2024-04-27 110810.png Screenshot 2024-04-27 111812.png

AEK

SuperUser

Hi @jnapier4

Please enter the following commands in FG CLI, then try ping the VLAN interface from VPN client.

diag debug flow filter addr <VPN-Client-IP>
diag debug flow filter proto 1
diag debug flow show function-name enable
diag debug flow show iprope enable
diag debug console timestamp enable
diag debug flow trace start 10
diag debug enable

Please share the output once done.

AEK

jnapier4Author

New Member

Here you go...

FortiGate-60F # 2024-04-27 12:39:57 id=20085 trace_id=1 func=print_pkt_detail line=5822 msg="vd-root:0 received a packet(proto=1, 172.16.0.50:1->10.235.30.1:2048) from ssl.root. type=8, code=0, id=1, seq=24."
2024-04-27 12:39:57 id=20085 trace_id=1 func=init_ip_session_common line=5993 msg="allocate a new session-0001e67c"
2024-04-27 12:39:57 id=20085 trace_id=1 func=iprope_dnat_check line=5121 msg="in-[ssl.root], out-[]"
2024-04-27 12:39:57 id=20085 trace_id=1 func=iprope_dnat_tree_check line=823 msg="len=0"
2024-04-27 12:39:57 id=20085 trace_id=1 func=iprope_dnat_check line=5134 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
2024-04-27 12:39:57 id=20085 trace_id=1 func=vf_ip_route_input_common line=2615 msg="find a route: flag=84000000 gw-10.235.30.1 via root"
2024-04-27 12:39:57 id=20085 trace_id=1 func=iprope_fwd_check line=765 msg="in-[ssl.root], out-[VLAN30], skb_flags-02000000, vid-0, app_id: 0, url_cat_id: 0"
2024-04-27 12:39:57 id=20085 trace_id=1 func=__iprope_tree_check line=557 msg="gnum-100004, use addr/intf hash, len=2"
2024-04-27 12:39:57 id=20085 trace_id=1 func=__iprope_check_one_policy line=1960 msg="checked gnum-100004 policy-3, ret-no-match, act-accept"
2024-04-27 12:39:57 id=20085 trace_id=1 func=__iprope_check_one_policy line=1960 msg="checked gnum-100004 policy-0, ret-matched, act-accept"
2024-04-27 12:39:57 id=20085 trace_id=1 func=__iprope_user_identity_check line=1777 msg="ret-matched"
2024-04-27 12:39:57 id=20085 trace_id=1 func=__iprope_check_one_policy line=2174 msg="policy-0 is matched, act-drop"
2024-04-27 12:39:57 id=20085 trace_id=1 func=iprope_fwd_check line=806 msg="after iprope_captive_check(): is_captive-0, ret-matched, act-drop, idx-0"
2024-04-27 12:39:57 id=20085 trace_id=1 func=fw_local_in_handler line=447 msg="iprope_in_check() check failed on policy 0, drop"
2024-04-27 12:40:02 id=20085 trace_id=2 func=print_pkt_detail line=5822 msg="vd-root:0 received a packet(proto=1, 172.16.0.50:1->10.235.30.1:2048) from ssl.root. type=8, code=0, id=1, seq=25."
2024-04-27 12:40:02 id=20085 trace_id=2 func=init_ip_session_common line=5993 msg="allocate a new session-0001e696"
2024-04-27 12:40:02 id=20085 trace_id=2 func=iprope_dnat_check line=5121 msg="in-[ssl.root], out-[]"
2024-04-27 12:40:02 id=20085 trace_id=2 func=iprope_dnat_tree_check line=823 msg="len=0"
2024-04-27 12:40:02 id=20085 trace_id=2 func=iprope_dnat_check line=5134 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
2024-04-27 12:40:02 id=20085 trace_id=2 func=vf_ip_route_input_common line=2615 msg="find a route: flag=84000000 gw-10.235.30.1 via root"
2024-04-27 12:40:02 id=20085 trace_id=2 func=iprope_fwd_check line=765 msg="in-[ssl.root], out-[VLAN30], skb_flags-02000000, vid-0, app_id: 0, url_cat_id: 0"
2024-04-27 12:40:02 id=20085 trace_id=2 func=__iprope_tree_check line=557 msg="gnum-100004, use addr/intf hash, len=2"
2024-04-27 12:40:02 id=20085 trace_id=2 func=__iprope_check_one_policy line=1960 msg="checked gnum-100004 policy-3, ret-no-match, act-accept"
2024-04-27 12:40:02 id=20085 trace_id=2 func=__iprope_check_one_policy line=1960 msg="checked gnum-100004 policy-0, ret-matched, act-accept"
2024-04-27 12:40:02 id=20085 trace_id=2 func=__iprope_user_identity_check line=1777 msg="ret-matched"
2024-04-27 12:40:02 id=20085 trace_id=2 func=__iprope_check_one_policy line=2174 msg="policy-0 is matched, act-drop"
2024-04-27 12:40:02 id=20085 trace_id=2 func=iprope_fwd_check line=806 msg="after iprope_captive_check(): is_captive-0, ret-matched, act-drop, idx-0"
2024-04-27 12:40:02 id=20085 trace_id=2 func=fw_local_in_handler line=447 msg="iprope_in_check() check failed on policy 0, drop"
2024-04-27 12:40:07 id=20085 trace_id=3 func=print_pkt_detail line=5822 msg="vd-root:0 received a packet(proto=1, 172.16.0.50:1->10.235.30.1:2048) from ssl.root. type=8, code=0, id=1, seq=26."
2024-04-27 12:40:07 id=20085 trace_id=3 func=init_ip_session_common line=5993 msg="allocate a new session-0001e6af"
2024-04-27 12:40:07 id=20085 trace_id=3 func=iprope_dnat_check line=5121 msg="in-[ssl.root], out-[]"
2024-04-27 12:40:07 id=20085 trace_id=3 func=iprope_dnat_tree_check line=823 msg="len=0"
2024-04-27 12:40:07 id=20085 trace_id=3 func=iprope_dnat_check line=5134 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
2024-04-27 12:40:07 id=20085 trace_id=3 func=vf_ip_route_input_common line=2615 msg="find a route: flag=84000000 gw-10.235.30.1 via root"
2024-04-27 12:40:07 id=20085 trace_id=3 func=iprope_fwd_check line=765 msg="in-[ssl.root], out-[VLAN30], skb_flags-02000000, vid-0, app_id: 0, url_cat_id: 0"
2024-04-27 12:40:07 id=20085 trace_id=3 func=__iprope_tree_check line=557 msg="gnum-100004, use addr/intf hash, len=2"
2024-04-27 12:40:07 id=20085 trace_id=3 func=__iprope_check_one_policy line=1960 msg="checked gnum-100004 policy-3, ret-no-match, act-accept"
2024-04-27 12:40:07 id=20085 trace_id=3 func=__iprope_check_one_policy line=1960 msg="checked gnum-100004 policy-0, ret-matched, act-accept"
2024-04-27 12:40:07 id=20085 trace_id=3 func=__iprope_user_identity_check line=1777 msg="ret-matched"
2024-04-27 12:40:07 id=20085 trace_id=3 func=__iprope_check_one_policy line=2174 msg="policy-0 is matched, act-drop"
2024-04-27 12:40:07 id=20085 trace_id=3 func=iprope_fwd_check line=806 msg="after iprope_captive_check(): is_captive-0, ret-matched, act-drop, idx-0"
2024-04-27 12:40:07 id=20085 trace_id=3 func=fw_local_in_handler line=447 msg="iprope_in_check() check failed on policy 0, drop"
2024-04-27 12:40:12 id=20085 trace_id=4 func=print_pkt_detail line=5822 msg="vd-root:0 received a packet(proto=1, 172.16.0.50:1->10.235.30.1:2048) from ssl.root. type=8, code=0, id=1, seq=27."
2024-04-27 12:40:12 id=20085 trace_id=4 func=init_ip_session_common line=5993 msg="allocate a new session-0001e6c8"
2024-04-27 12:40:12 id=20085 trace_id=4 func=iprope_dnat_check line=5121 msg="in-[ssl.root], out-[]"
2024-04-27 12:40:12 id=20085 trace_id=4 func=iprope_dnat_tree_check line=823 msg="len=0"
2024-04-27 12:40:12 id=20085 trace_id=4 func=iprope_dnat_check line=5134 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
2024-04-27 12:40:12 id=20085 trace_id=4 func=vf_ip_route_input_common line=2615 msg="find a route: flag=84000000 gw-10.235.30.1 via root"
2024-04-27 12:40:12 id=20085 trace_id=4 func=iprope_fwd_check line=765 msg="in-[ssl.root], out-[VLAN30], skb_flags-02000000, vid-0, app_id: 0, url_cat_id: 0"
2024-04-27 12:40:12 id=20085 trace_id=4 func=__iprope_tree_check line=557 msg="gnum-100004, use addr/intf hash, len=2"
2024-04-27 12:40:12 id=20085 trace_id=4 func=__iprope_check_one_policy line=1960 msg="checked gnum-100004 policy-3, ret-no-match, act-accept"
2024-04-27 12:40:12 id=20085 trace_id=4 func=__iprope_check_one_policy line=1960 msg="checked gnum-100004 policy-0, ret-matched, act-accept"
2024-04-27 12:40:12 id=20085 trace_id=4 func=__iprope_user_identity_check line=1777 msg="ret-matched"
2024-04-27 12:40:12 id=20085 trace_id=4 func=__iprope_check_one_policy line=2174 msg="policy-0 is matched, act-drop"
2024-04-27 12:40:12 id=20085 trace_id=4 func=iprope_fwd_check line=806 msg="after iprope_captive_check(): is_captive-0, ret-matched, act-drop, idx-0"
2024-04-27 12:40:12 id=20085 trace_id=4 func=fw_local_in_handler line=447 msg="iprope_in_check() check failed on policy 0, drop"