Skip to main content
toms73
New Member
January 17, 2019
Question

Configure mgmt interface with vlan | can't ping in from remote location

  • January 17, 2019
  • 1 reply
  • 10717 views

Version: FortiGate-VM64-KVM v5.4.4,build7605,170208 (GA)

I'm trying to setup fortinet management going through port1 with vlan 333, I was able to ping out from fortinet to outside world but unable to ping into fortinet from remote location. the setup is the following 

PC -> Juniper NFX250 -> Fortinet 

 

Please let me know as to why the packets are not going out from port1?

Did I do setup correctly?

I have another product attached to Juniper NFX250 and I can ping in and out without any issues.

 

below is my setup:

FortiGate-VM64-KVM (interface) # show

config system interface
    edit "port1"
        set vdom "root"

        set allowaccess ping https ssh http fgfm

        set type physical

        set role wan

        set snmp-index 2

    next

    edit "port2"

        set vdom "root"

        set type physical

        set snmp-index 3

    next

    edit "port3"

        set vdom "root"

        set type physical

        set snmp-index 4

    next

    edit "ssl.root"

        set vdom "root"

        set type tunnel

        set alias "SSL VPN interface"

        set snmp-index 1

    next

    edit "vlan333"

        set vdom "root"

        set ip 10.92.24.106 255.255.255.0

        set allowaccess ping https ssh http fgfm

        set role lan

        set snmp-index 5

        set interface "port1"

        set vlanid 333

    next

end



FortiGate-VM64-KVM # get router info routing-table all

Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP

       O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

       * - candidate default

 

C 10.92.24.0/24 is directly connected, vlan333
 below is what I'm seeing when I try to ping from remote location to Fortinet, the packets are coming in but going no where...

FortiGate-VM64-KVM # diag sniffer packet port1 "icmp" 10.92.24.106 -I port1
interfaces=[port1]
filters=[icmp]
pcap_lookupnet: port1: no IPv4 address assigned

0 packets received by filter
0 packets dropped by kernel

FortiGate-VM64-KVM # diag sniffer packet vlan333 "icmp" 10.92.24.106 -I port1
interfaces=[vlan333]
filters=[icmp]
3.796072 10.88.233.1 -> 10.92.24.106: icmp: echo request
4.795824 10.88.233.1 -> 10.92.24.106: icmp: echo request

 I'm also seeing this:

FortiGate-VM64-KVM # id=20085 trace_id=21 func=print_pkt_detail line=4793 msg="vd-root received a packet(proto=17, 0.0.0.0:68->255.255.255.255:67) from vlan333. "

id=20085 trace_id=21 func=init_ip_session_common line=4944 msg="allocate a new session-00002e79"

id=20085 trace_id=21 func=vf_ip_route_input_common line=2586 msg="find a route: flag=90000000 gw-255.255.255.255 via root"

id=20085 trace_id=21 func=fw_local_in_handler line=390 msg="iprope_in_check() check failed on policy 0, drop"

id=20085 trace_id=22 func=print_pkt_detail line=4793 msg="vd-root received a packet(proto=2, 10.92.24.44:0->224.0.0.251:0) from vlan333. "

id=20085 trace_id=22 func=init_ip_session_common line=4944 msg="allocate a new session-00002e7a"

id=20085 trace_id=22 func=ip_session_handle_no_dst line=5018 msg="trace"
 

 

 

    1 reply

    lobstercreed
    New Member
    January 18, 2019

    Do you have trusted hosts set in your admin profiles?  All admin access methods are only allowed from trusted hosts.  You may have to open management up to the outside world if you want to ping from the outside world.

    toms73
    toms73Author
    New Member
    January 18, 2019

    maybe it's broken with VLAN. I've tried but nothing with VLAN, works fine without VLAN. Do you mind giving examples or point a doc on this for CLI? The password is removed below....

    FortiGate-VM64-KVM (admin) # show

     

    config system admin

     

        edit "admin"

     

            set accprofile "super_admin"

     

            set vdom "root"

     

            set password ENC SH233pCKxJsRW96bJRMrjBtq3kUCo7ZRYnqqd/xxxxxxxxxxx

     

        next

     

        edit "doc-admin"

     

            set trusthost1 10.0.0.0 255.0.0.0

     

            set trusthost2 192.168.0.0 255.255.0.0

     

            set accprofile "super_admin"

     

            set vdom "root"

     

        next

     

    end

     

    Toshi_Esumi
    SuperUser
    SuperUser
    January 18, 2019

    Because you don't have a route back to 10.88.233.1.