Been working on this for awhile and no luck. I have two subnets that I need to allow communication between, 10.1.2.0 and 192.168.1.0. This seems simple but I am missing something somewhere. FortiOS 7.2.5 on FortiGate 60F. Each subnet a physical hardware port on the FortiGateI do have Firewall Policy allowing communication between the two with no NAT.Do I need to add a static route?Thanks for any help.

New Member

Question

Communication between subnets

Forum|Forum|3 years ago
June 26, 2023
18 replies
7725 views

Been working on this for awhile and no luck. I have two subnets that I need to allow communication between, 10.1.2.0 and 192.168.1.0. This seems simple but I am missing something somewhere.

FortiOS 7.2.5 on FortiGate 60F.
Each subnet a physical hardware port on the FortiGate
I do have Firewall Policy allowing communication between the two with no NAT.

Do I need to add a static route?

Thanks for any help.

FortiGate

Show previous replies

Nicolai_Mohr

New Member

Hi @wraithhunter,

can you get the output of the diagnose debug flow command with this syntax:

# diagnose debug enable

# diagnose debug flow filter addr 10.1.2.239

# diagnose debug flow show function-name enable

# diagnose debug flow trace start 100

This should show the policy id which blocks the traffic.

wraithhunterAuthor

New Member

id=65308 trace_id=89 func=init_ip_session_common line=5964 msg="allocate a new session-02d29f66, tun_id=0.0.0.0"
id=65308 trace_id=89 func=rpdb_srv_match_input line=1046 msg="Match policy routing id=2: to 10.1.2.100 via ifindex-36"
id=65308 trace_id=89 func=vf_ip_route_input_common line=2605 msg="find a route: flag=84000000 gw-10.1.2.100 via root"
id=65308 trace_id=89 func=fw_local_in_handler line=606 msg="iprope_in_check() check failed on policy 0, drop"
id=65308 trace_id=90 func=print_pkt_detail line=5779 msg="vd-root:0 received a packet(proto=1, 192.168.1.199:1->10.1.2.239:2048) tun_id=0.0.0.0 from internal. type=8, code=0, id=1, seq=9184."
id=65308 trace_id=90 func=init_ip_session_common line=5964 msg="allocate a new session-02d29f69, tun_id=0.0.0.0"
id=65308 trace_id=90 func=rpdb_srv_match_input line=1046 msg="Match policy routing id=2: to 10.1.2.100 via ifindex-36"
id=65308 trace_id=90 func=vf_ip_route_input_common line=2605 msg="find a route: flag=84000000 gw-10.1.2.100 via root"
id=65308 trace_id=90 func=fw_local_in_handler line=606 msg="iprope_in_check() check failed on policy 0, drop"
id=65308 trace_id=91 func=print_pkt_detail line=5779 msg="vd-root:0 received a packet(proto=6, 192.168.1.199:1133->10.1.2.239:81) tun_id=0.0.0.0 from internal. flag [S], seq 1550623952, ack 0, win 64240"