Skip to main content
navin_cool
navin_cool
New Member
December 29, 2015
Question

Fortigate Firewall is not sending traffic to upstrem Firewall

  • December 29, 2015
  • 1 reply
  • 5415 views

Hi,

 

We are using two Firewall layers (Brick and Fortigate).

Internet line is connected to Brick Firewall, where NATting configured.

A direct connection made between Brick and Fortigate Firewall. From Fortigate Firewall connection going to LAN.

 

I was trying to configure a Lan-Lan tunnel in Brick Firewall (between my office to other partner office), with all of sudden a strange behavior observed in Fortigate Firewall.  

 

Fortigate Firewall does not sending the traffic to Brick F/w (or) Fortigate F/w does not shows any Internet related logs, except Private Ip address in Traffic logs. When I look at events, I see a critical alerts "Ping Peer: 8.8.8.8 is down". 

These events are generating when I do Shutdown and no shutdown the port between Fortigate and Brick F/w's.

And then for few seconds Internet is accessible, then automatically shows no internet.

 

I did cable re connections, reboot Brick and Fortigate Firewalls, still same issue. I dont understand this behavior.

Could any one of you, please help me to address this issue.

 

 

Regards

Naveen 

    1 reply

    JohnAgora
    JohnAgora
    New Member
    December 29, 2015

    Have you setup routes and firewall policies?

    Also you can check that both FW have connectivity (ping for example).

     

    If that doesn't work, you can do some diagnose on the traffic.

    For example

    diagnose debug enable

    diagnose debug flow filer addr <IP_ADDR_OF_DEVICE>

    diagnose debug flow trace start 10

     

    And then read what is happening to the traffic.

    navin_cool
    navin_coolAuthor
    New Member
    December 30, 2015

    Required Routes and Policies are in place already. It was working fine and during configuring L2L VPN in Brick firewall, this issue raised.  I am able to ping both Firewalls interface Ip address from my LAN machine.

    I will do the debug today and look for the logs.

    navin_cool
    navin_coolAuthor
    New Member
    December 30, 2015

    Internet access is restored, after deselect below option under WAN1 interface (which is connecting to Brick Firewall)

    "Detect Interface Status for Gateway Load Balancing"

    It was selected and configured with Detect Server: 8.8.8.8

    I understand this option is for ECMP. But I am not sure why it has enabled earlier and working fine.

    However still, i see few private IP address communication is denying in the Fortigate Firewall. 

    Terms & ConditionsAccessibility statement