Skip to main content
ABE_63
New Member
March 18, 2024
Solved

Firewall Policies not working as expected

  • March 18, 2024
  • 1 reply
  • 4525 views

I have removed two physical interfaces (internal2 and internal3) from the internal interface. I gave internal2 192.168.10.1/24 and internal3 192.168.20.1/24. I connected a device to port 2 and gave it the IP address 192.168.10.10/24. I plugged another device into internal3 and gave it 192.168.20.10. I made sure each device could ping it's own gateway .1 address. I then tried to ping the opposite IP gateway which as expected did not work. I then created a firewall policy called 10 to 20, Inc int: internal2, Out int: internal3, source: all, destination: all, service: all. Action: accept. Apart from disabling NAT and setting the logging to All Sessions (which doesn't seem to be logging anything by the way, but that's a separate issue) everything else was left as default. Yet I can't seem to ping one device from another. I can't even ping the opposite gateway. What am I doing wrong?

Best answer by Toshi_Esumi

Make sure you have two policies from internal2 to internal3 and from internal3 to internal2.
Try sniffing 'any' interface for icmp, then ping from one side to the other. Like...
diag sniffer packet any 'icmp' 4 0 l (last letter is lower-case 'L')
You should see in and out packets on both interfaces.

For the log issue, you should see even the ping sessions in Log&Report->Forward Traffic if you ping "through" the FGT.

Toshi

1 reply

Toshi_Esumi
SuperUser
SuperUser
March 18, 2024

Make sure you have two policies from internal2 to internal3 and from internal3 to internal2.
Try sniffing 'any' interface for icmp, then ping from one side to the other. Like...
diag sniffer packet any 'icmp' 4 0 l (last letter is lower-case 'L')
You should see in and out packets on both interfaces.

For the log issue, you should see even the ping sessions in Log&Report->Forward Traffic if you ping "through" the FGT.

Toshi

ABE_63
ABE_63Author
New Member
March 18, 2024

I have a ping now but the Log&Report->Forward Traffic is empty. Any ideas why this isn't working?

 

Toshi_Esumi
SuperUser
SuperUser
March 18, 2024

Are you pinging through the FGT from one interface to the other to an actual device?
You're logging onto and viewing on memory log, right?

 

Toshi