Dual WAN LINK interface administration

Are you trying to access your WAN2 management interface from the inside or Internet?

Hi, I am trying to access it from Internet

Hello august_twenty8, Can you check if both default routes are in the routing table ; from CLI : " get router info routing-table all" Jabo.

This is what I get S* 0.0.0.0/0 [5/0] via 219.a.b.c, wan1 [5/0] via 219.d.e.f, wan2 192.168.10.0/24 is directly connected, internal 192.168.254.0/24 [10/0] is directly connected, ssl.root 219.a.b.c/29 is directly connected, wan1 219.d.e.f/29 is directly connected, wan2

On the command line you can run: diag sniffer packet wan2 ' port 443' Then test from the outside and see if you see any incoming packets to your Fortinet. I had an issue with someone else yesterday and their WAN1 ISP was filtering out packets whereas on WAN2 they were not.

When enter the $ diag sniffer packet wan2 " port 443" and I ping to the interface it return me nothing. but when I telnet it 443 it return me this result 165.060076 59.108.29.151.443 -> 219.95.111.222.1060: syn 2523256685 ack 3592316543 165.060220 219.95.111.222.1060 -> 59.108.29.151.443: ack 2523256686 165.064246 219.95.111.222.1060 -> 59.108.29.151.443: psh 3592316543 ack 2523256686 165.144222 59.108.29.151.443 -> 219.95.111.222.1060: ack 3592316652 165.157043 59.108.29.151.443 -> 219.95.111.222.1060: 2523256686 ack 3592316652 165.157177 219.95.111.222.1060 -> 59.108.29.151.443: ack 2523258134

To see pings also you will need this: diag sniffer packet wan2 ' port 443 and icmp' But the SSL stuff looks good. In your Admin profile are you restricting access from specific hosts are are your admins set to 0.0.0.0/0.0.0.0 for all trusted hosts?

In my Admin > Administrators , Trusted Hosts 0.0.0.0/0 0.0.0.0/0 0.0.0.0/0, when i enter $diag sniffer packet wan2 " port 443 and icmp" interfaces=[wan2] filters=[port 443 and icmp] pcap_compile: expression rejects all packets $diag sniffer packet wan2 " port 443 or icmp" It return me 163.169708 219.a.b.222 -> 202.188.0.133: icmp: echo request 163.173185 202.188.0.133 -> 219.a.b.222: icmp: echo reply 168.209592 219.a.b.222 -> 202.188.0.133: icmp: echo request 168.223087 202.188.0.133 -> 219.a.b.222: icmp: echo reply I think the I already set ping server into wan2 and also wan1 .. 202.188.0.133 is the dns that i point my ping server to ping For ping server what next hop router should we put, is it alright if I keep pinging the dns server?

I am having the same issue. Just hooked up WAN2 on a 200A and I cannot get HTTPS Admin working on that interface. The packets are seen coming to WAN2 but are not being accepted.

  fort01 # diag sniffer packet any ' port 443 and host 8.7.25.18'     interfaces=[any]    filters=[port 443 and host 8.7.25.23]    4.212088 8.7.25.18.57378 -> 71.118.12.84.443: syn 3797564345   7.215133 8.7.25.18.57378 -> 71.118.12.84.443: syn 3797564345   13.204260 8.7.25.18.57378 -> 71.118.12.84.443: syn 3797564345  25.202414 8.7.25.18.57378 -> 71.118.12.84.443: syn 3797564345  49.199476 8.7.25.18.57378 -> 71.118.12.84.443: syn 3797564345     5 packets received by filter  0 packets dropped by kernel  

  S*      0.0.0.0/0 [1/0] via 65.214.187.49, wan1  C       10.0.0.0/23 is directly connected, internal  C       10.0.5.0/24 is directly connected, dmz2  S       10.10.20.100/30 [2/0] is directly connected, ssl.root  S       10.10.20.104/29 [2/0] is directly connected, ssl.root  S       10.10.20.112/28 [2/0] is directly connected, ssl.root  S       10.10.20.128/26 [2/0] is directly connected, ssl.root  S       10.10.20.192/29 [2/0] is directly connected, ssl.root  S       10.10.20.200/32 [2/0] is directly connected, ssl.root  C       65.214.187.48/28 is directly connected, wan1  C       71.118.12.0/24 is directly connected, wan2  

Will not answer pings either.

  fort01 # diag sniffer packet wan2 ' host 8.7.25.181'     interfaces=[wan2]    filters=[host 8.7.25.181]    7.832028 8.7.25.181 -> 71.118.12.84: icmp: echo request  8.833358 8.7.25.181 -> 71.118.12.84: icmp: echo request  9.832492 8.7.25.181 -> 71.118.12.84: icmp: echo request  10.832368 8.7.25.181 -> 71.118.12.84: icmp: echo request  11.832966 8.7.25.181 -> 71.118.12.84: icmp: echo request  12.832088 8.7.25.181 -> 71.118.12.84: icmp: echo request    6 packets received by filter  0 packets dropped by kernel  

dbsanders, do you have 8.7.25.181 in your trusted hosts in the admin configuration? Or are they all 0.0.0.0/0.0.0.0?