Skip to main content
jaiganeshbsc
jaiganeshbsc
New Member
October 27, 2016
Question

Fortigate 200B Unable to connect to Branch Office MPLS

  • October 27, 2016
  • 1 reply
  • 4650 views

I have a fortigate 200B. Internal network (switch) is setup with 192.168.1.x. 1 WAN link with Internet connected to port 9. In this setup everything is working fine. Now have to connect with HO via MPLS. Which is connected to port 10 with IP 10.202.96.2 and Gateway for the same is 10.202.96.1.

I have created policies to allow communication to and from port 10 & switch.

When pinging from within the Fortigate CLI I can ping the port 10 interface IP 10.202.96.2 as well as the MPLS Gateway 10.202.96.1.

 

I have even setup a secondary IP to the switch as 10.202.96.10. However from the switch interface I am not able to ping 10.202.96.2 (port 10) or the Gateway. Fortigate seems to drop packets to this subnet.

Please assist with the setup as I am new to Fortigate.

 

Thanks

Jaiganesh.

 

    1 reply

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    October 27, 2016

    As in many threads in the past, if you can't ping an interface from the opposite side of the cable, it's because either 1) ping is not allowed on the interface, or 2) trusthosts are configured but don't include the IP you're pinging from.

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    October 28, 2016

    Search for "diag debug flow" in the forums and run it, then post.

    jaiganeshbsc
    jaiganeshbscAuthor
    New Member
    October 28, 2016

    Please find the below result when pinging the MPLS Gateway from within CLI keeping the source address as 192.168.1.1 (Interal)

     

    FOrtigate  $ exec ping-options source 192.168.1.1   FOrtigate  $ exec ping 10.202.96.1 id=13 trace_id=31 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=1, 192.168.1.1:16896->10.202.96.1:8) from local. code=8, type=0, id=16896, seq=0." id=13 trace_id=31 func=init_ip_session_common line=4469 msg="allocate a new session-0037fecf" id=13 trace_id=32 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=1, 192.168.1.1:16896->10.202.96.1:8) from local. code=8, type=0, id=16896, seq=256." id=13 trace_id=32 func=resolve_ip_tuple_fast line=4372 msg="Find an existing session, id-0037fecf, original direction" id=13 trace_id=33 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=1, 192.168.1.1:16896->10.202.96.1:8) from local. code=8, type=0, id=16896, seq=512." id=13 trace_id=33 func=resolve_ip_tuple_fast line=4372 msg="Find an existing session, id-0037fecf, original direction" id=13 trace_id=34 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=1, 192.168.1.1:16896->10.202.96.1:8) from local. code=8, type=0, id=16896, seq=768." id=13 trace_id=34 func=resolve_ip_tuple_fast line=4372 msg="Find an existing session, id-0037fecf, original direction" id=13 trace_id=35 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=1, 192.168.1.1:16896->10.202.96.1:8) from local. code=8, type=0, id=16896, seq=1024." id=13 trace_id=35 func=resolve_ip_tuple_fast line=4372 msg="Find an existing session, id-0037fecf, original direction" PING 10.202.96.1 (10.202.96.1): 56 data bytes   --- 10.202.96.1 ping statistics --- 5 packets transmitted, 0 packets received, 100% packet loss

     

    Appreciate any possible help resolving this connectivity issue.

     

    Nilgirs_HO_UTM $ exec ping-options source 192.168.1.1
     
    Nilgirs_HO_UTM $ exec ping 10.202.96.1
    id=13 trace_id=31 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=1, 192.168.1.1:16896->10.202.96.1:8) from local. code=8, type=0, id=16896, seq=0."
    id=13 trace_id=31 func=init_ip_session_common line=4469 msg="allocate a new session-0037fecf"
    id=13 trace_id=32 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=1, 192.168.1.1:16896->10.202.96.1:8) from local. code=8, type=0, id=16896, seq=256."
    id=13 trace_id=32 func=resolve_ip_tuple_fast line=4372 msg="Find an existing session, id-0037fecf, original direction"
    id=13 trace_id=33 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=1, 192.168.1.1:16896->10.202.96.1:8) from local. code=8, type=0, id=16896, seq=512."
    id=13 trace_id=33 func=resolve_ip_tuple_fast line=4372 msg="Find an existing session, id-0037fecf, original direction"
    id=13 trace_id=34 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=1, 192.168.1.1:16896->10.202.96.1:8) from local. code=8, type=0, id=16896, seq=768."
    id=13 trace_id=34 func=resolve_ip_tuple_fast line=4372 msg="Find an existing session, id-0037fecf, original direction"
    id=13 trace_id=35 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=1, 192.168.1.1:16896->10.202.96.1:8) from local. code=8, type=0, id=16896, seq=1024."
    id=13 trace_id=35 func=resolve_ip_tuple_fast line=4372 msg="Find an existing session, id-0037fecf, original direction"
    PING 10.202.96.1 (10.202.96.1): 56 data bytes
     
    --- 10.202.96.1 ping statistics ---
    5 packets transmitted, 0 packets received, 100% packet loss
    Terms & ConditionsAccessibility statement