Skip to main content
Leaky5
Leaky5
New Member
June 3, 2024
Question

Checking traffic through an F60

  • June 3, 2024
  • 1 reply
  • 2838 views

I have a Fortigate F60 and cant quite work something out on it. I dont actually use it much, more of a Cisco guy I am afraid.

 

I have a Cisco router, which has 2 interfaces which connect to InternalX and InternalZ for ease.

These router are interfaces used to terminate DMVPN tunnels.

The one on internalX works fine, I can run captures on InternalX and the WAN interfaces and see traffic passing both and the DMVPN tunnel through InternalX is up.

 

But for the one that goes to InternalZ, I see the DMVPN set up packets hit InternalZ, but never see them on the outside interfaces and never see return traffic. It also never hits the remote DMVN router.

 

There is a rule for each connection through InternalX & Z and they are identical apart from the source IP.

 

Does anyone have any ideas why this is not passing through the firewall ?

 

 

1 reply

adambomb1219
SuperUser
adambomb1219
SuperUser
June 3, 2024

What exactly is the topology here?  What mode is the FortiGate in?  

    Leaky5
    Leaky5Author
    New Member
    June 3, 2024

    How do I check what mode it is in pls ?FG.jpg

    Debbie_FTNT
    Staff & Editor
    Debbie_FTNT
    Staff & Editor
    June 3, 2024

    Hey Leaky,

    you can see the mode on the default Dashboard, in the system widget:

     

    image.png

     

    In your case, as both internalZ and internalX connect to the same Cisco Router, what does your routing look like? Do you have different subnets on those connections? What does the routing table on the FortiGate look like?

    You can get a better idea of why FortiGate is not accepting traffic on internalZ with these commands:

     

    #dia de flow filter reset

    #dia de flow filter addr <IP of G0/0/0>

    #dia de flow show iprope en

    #dia de flow show function-name en

    #dia de console timestamp en

    #dia de flow trace start <number of packets>

    #dia de en

     

    Then generate traffic from G0/0/0 to the DMVPN, and check the output in FortiGate CLI; it might show you some error like 'denied by policy 0', meaning no matching policy was found, or 'reverse path check fail, drop' meaning the route back to G0/0/0 IP does not go via internalZ and the traffic is dropped on routing grounds.

     

    I hope this helps!
    Cheers,

    Debbie

    Terms & ConditionsAccessibility statement