Skip to main content
Kenundrum
New Member
August 31, 2009
Question

Can' t route past default gateway

  • August 31, 2009
  • 5 replies
  • 3637 views
I had a strange issue this weekend with one of my FGT-60Bs. it is connected to a cable modem through the WAN1 port and has a 3G wireless card failover. It failed over to the wireless card- so we thought the cable provider was down. After various troubleshooting steps, we were able to figure this out... From inside we can ping our default gateway. From outside, we could ping the default gateway. Could not ping anything past the gateway from inside or to us from outside. The internet was working fine through the 3G card. (outside tests involved remote controlling a computer at a remote site not connected through a VPN) The cable provider did a few things on their end, but still nothing. Eventually we plugged a computer directly to the modem and it worked perfectly. Switched the connection from the WAN1 to WAN2 and all of a sudden it works fine... (obviously after configuring the default gateway and firewall policies to use WAN2) Is this indicative of a bad port somehow? i' m finding it hard to believe that we could ping out but not get routing. i' d expect that a dead interface would just not work no matter what. but also that if we had something wrong in the configuration that it would also be wrong when we set up the WAN2... any ideas? Thanks

    5 replies

    darrell
    New Member
    August 31, 2009
    Perhaps your MAC address for your WAN1 port got de-registered and would not re-register with the cable provider? Changing to WAN2 would change your MAC address presented to the cable co, obviously. Our cable co normally tells you to power off your cable modem for 30 minutes to clear things out of their system (great fix, huh?), but it does actually seem to work some of the time.
    Kenundrum
    KenundrumAuthor
    New Member
    August 31, 2009
    The tech at the Cable Co was able to clear the ARP and reset the MAC history etc etc out of our modem and their routers... he was able to detect that it was a fortinet once it was up on WAN2... i might try switching back to the original tonight and see what happens. it is such a pain to try to re-enter all of our firewall rules using WAN2 instead of WAN1 as the primary internet interface...
    g3rman
    New Member
    August 31, 2009
    You can copy and paste the rules on the command line, much faster. " show firewall policy"
    laf
    New Member
    September 17, 2009
    You can copy and paste the rules on the command line, much faster. " show firewall policy"
    This has nothing to do with FW policies. He should be able to ping from the equipment' s console. So just check how s your ping in the GW: steady? Check the TTL value and after this issue a traceroute to 4.2.2.2. Post the results. Also tell us what do you see at Router- Monitor !
    darrell
    New Member
    September 1, 2009
    Can you just changed the src and dst iface via command line easily? It' s not like you have to rewrite the whole rule that way.
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.