Skip to main content
MarcusI
New Member
July 11, 2018
Question

Change Fortigate 80C to Fortigate 80E and now we can't go out to internet

  • July 11, 2018
  • 2 replies
  • 9214 views

Hi all, I need help with this issue:

 

We have a fortigate 80C and we acquire a fortigate 80E and we charge it all configuration on this last one. When we change the connection of our ISP to WAN1 in the Fortigate 80E, the fortigate can acces to internet but any computer from our red can't acces to the internet. We reset the Fortigate 80E again to erase any configuration and we setting only the basic to acces to internet but even with this we can't acces to internet. This is what we have setting in the router 80E: config system interface     edit "wan1"         set vdom "root"         set ip xxx.xxx.xxx.xxx 255.255.255.252         set allowaccess ping https http fgfm         set type physical         set role wan         set snmp-index 1     next By default DNS’s of Fortigate config system dns     set primary 208.91.112.53     set secondary 208.91.112.52 end config firewall policy     edit 1         set name "INTERNET"         set uuid 61394098-8487-51e8-f1de-1075f1a12a3a         set srcintf "lan"         set dstintf "wan1"         set srcaddr "all"         set dstaddr "all"         set action accept         set schedule "always"         set service "ALL"         set logtraffic all         set nat enable     next config router static     edit 1         set gateway xxx.xxx.xxx.xxx         set device "wan1"     next end config router policy     edit 1         set input-device "lan"         set src "192.168.X.X/255.255.255.0"         set output-device "wan1"     next

 

With this settings if we put in a PC the DNS's of google , this PC can access to the Internet. The problem sould be DNS but with the fortigate 80C works fine.

 

Thanks in advance.

 

    2 replies

    ede_pfau
    SuperUser
    SuperUser
    July 11, 2018

    The config for testing is not that complicated, it looks OK.

    Except for the policy route - why do you think you would need it? Leave it out while testing.

    For system DNS, you can use 9.9.9.9 and 9.9.9.10. They work independent of any licence status.

     

    If you get tired of guessing you could just look at the traffic: diag debug flow is your friend.

     

    Toshi_Esumi
    SuperUser
    SuperUser
    July 11, 2018

    I would suggest removing the policy route "config router policy", then check DHCP server config for "lan" interface and what DNS server IPs each device has/gets.

    emnoc
    New Member
    July 11, 2018

    You need to do more diagnostic

     

    (cli cmd tips )

     

    diag arp list

    diag debug flow

      { set the filter options}

     

    diag sniffer packet wan1 "any"  might help also to see what's going out to the wan

     

    But I have to agree  with  observation, your config is not complex by any means and you  don't need the   PBR

     

    Ken

    MarcusI
    MarcusIAuthor
    New Member
    July 12, 2018

    Hi, Thanks all for your answers, we're going to apply your advices and we let you know the results. Thanks again