Skip to main content
kunglo
kunglo
New Member
June 4, 2025
Question

FortiGate 200G "traceroute operation not permitted" error — how to fix?

  • June 4, 2025
  • 2 replies
  • 3032 views

Hi everyone,

Spoiler

สวัสดีทุกคน

ฉันกำลังใช้ **FortiGate 200G** รัน **FortiOS [เวอร์ชัน — ใส่เวอร์ชันของคุณที่นี่ egv7.2.8]**

เมื่อฉันรันคำสั่งต่อไปนี้จาก CLI:

ดำเนินการ traceroute-options source 49.231.244.67
ดำเนินการ traceroute 49.231.244.70
ฉันได้รับข้อความแสดงข้อผิดพลาดนี้:

traceroute ถึง 49.231.244.70 (49.231.244.70), สูงสุด 32 ฮ็อป, 3 แพ็คเก็ตโพรบต่อฮ็อป, แพ็คเก็ต 84 ไบต์
1 49.231.244.70 <m.lannapoly.ac.th> 0.028 มิลลิวินาที
traceroute: sendto: การดำเนินการไม่ได้รับอนุญาต
traceroute: เขียน 49.231.244.70 84 ตัวอักษร, ret=-1

 

มีใครเคยเห็นปัญหานี้มาก่อนหรือไม่?

I updated FGT_200G-v7.2.11.M-build6561-FORTINET and this fixed the issue.

2 replies

dingjerry_FTNT
Staff
dingjerry_FTNT
Staff
June 4, 2025

Hi @kunglo ,

 

Could you please provide the following?

 

1) FGT config

2) Routing table on FGT

    kunglo
    kungloAuthor
    New Member
    June 4, 2025

    Actually, the issue I'm seeing is this:
    I'm forwarding traffic (FWP) via IP xx.xxx.244.70, and when I perform a traceroute using source IP xx.xxx.244.67, I get an "operation not permitted" message. Interestingly, it appears once, and then subsequent attempts also show "operation not permitted."

    Since the FG-200G is still new in our environment, I’m not sure if others have encountered the same issue.

    Regarding the FGT config — do you need the full configuration or just specific sections?

    Thank you.

     

     

    dingjerry_FTNT
    Staff
    dingjerry_FTNT
    Staff
    June 4, 2025

    It's better with the full FGT config. You may mask the sensitive settings.

     

    Also, please show us the network diagram that includes 49.231.244.70.

    Yurisk
    SuperUser
    Yurisk
    SuperUser
    June 4, 2025

    I've see recently such issues on FGT-VM (KVM-based) - was a host KVM problem, restarted the FGT-VM and all worked fine. 

    In your case - do you get the same error if you traceroute some regular IP, like 8.8.8.8? 

    Do you get the error if tracerouting your destination w/o setting the source address?

     

    In general, the error means that sending traceroute packets (high port UDP) in general or to the specific destination is prohibited - may be on FGT itself, or a router/firewall this FGT is connected to as its gateway.

     

    By the look of it - I'd guess you are trying to traceroute FGT itself, of IP belonging to the routed to the FGT, which will not work.

    kunglo
    kungloAuthor
    New Member
    June 4, 2025

     

    When I traceroute to other IPs, it works normally.

     

    However, when I try to traceroute to xx.xx.244.70 (which is the IP I have configured for FWP), I receive the following error: mstraceroute: sendto: Operation not permitted

     

    As I understand it, when tracerouting to my own forwarded IP like this, I should typically see myself in a single hop, correct?

    Yurisk
    SuperUser
    Yurisk
    SuperUser
    June 4, 2025

    Nope, it will not work, not to mention - why would you try to do this, what would it give you?

    Terms & ConditionsAccessibility statement