Explorer II

Question

Guest VM not getting internet access through Fortigate firewall VM..

Forum|Forum|7 years ago
November 14, 2018
3 replies
10196 views

I'm doing the following network setup (first time with firewall) but it's not working, unsure where its going wrong.

I have a Fortigate VM firewall port 1 IP 192.168.132.5 on vmnet8(NAT) in VMWare, host vmnet8(NAT) IP 192.168.132.1, guest VM IP is issued by DHCP from Fortigate firewall (working).

I have a static route to host vmnet8(NAT).

The firewall VM and guest VM can ping host vmnet8(NAT) interface but do not get internet.

I have created a policy to allow WAN on LAN IPs (guest VM).

Anything I'm missing.

Guest Vm IP from DHCP : https://i.stack.imgur.com/sFip0.png

Firewall VM Port configuration : https://i.stack.imgur.com/EdsgH.png

Static Route : https://i.stack.imgur.com/Mmkp7.png

WAN Policy : https://i.stack.imgur.com/Bzjwq.png

Host IP : https://i.stack.imgur.com/xO4a8.png

Thank You

sw2090

SuperUser

hmm

looks good so far.

you set a static default route to your host. So yur FGT will route any internet traffic to 192.168.132.1 and then 192.168.132.1 would have to take care for further routing/NATing to the internet.

You could prove that on FGT Cli using flow debug:

diag debiug enable

diag debug flow show console enable

diag debug flow filter clear

diag debug flow filter saddr <ip of your guest vm>

diag debug flow trace start <numberofpackets>

and you will see any traffic coming from your guest vm to the FGT and what the FGT does with it.

If it gets routet correctly you would have to check wether your static default route is correct or not (or the routing/NATing on your host works).

huudAuthor

Explorer II

sw2090 wrote:
hmm

looks good so far.
you set a static default route to your host. So yur FGT will route any internet traffic to 192.168.132.1 and then 192.168.132.1 would have to take care for further routing/NATing to the internet.

You could prove that on FGT Cli using flow debug:

diag debiug enable
diag debug flow show console enable
diag debug flow filter clear
diag debug flow filter saddr <ip of your guest vm>
diag debug flow trace start <numberofpackets>

and you will see any traffic coming from your guest vm to the FGT and what the FGT does with it.
If it gets routet correctly you would have to check wether your static default route is correct or not (or the routing/NATing on your host works).

Thank you for the assistance,

The static route is o my Laptop which is the host and it has internet access.

I tried the above and the following are the results, wan't able to understand much..

diagnose debug flow trace start 5

 
FortiGate-VM64 # id=20085 trace_id=11 func=print_pkt_detail line=4918 msg="vd-root received a packet(proto=17, 192.168.3.108:62887->208.91.112.53:53) from port3. "
id=20085 trace_id=11 func=resolve_ip_tuple_fast line=4982 msg="Find an existing session, id-000105d6, original direction"
id=20085 trace_id=11 func=__ip_session_run_tuple line=2893 msg="SNAT 192.168.3.108->192.168.132.50:62887"
id=20085 trace_id=11 func=__ip_session_run_tuple line=2944 msg="run helper-dns-udp(dir=original)"
id=20085 trace_id=12 func=print_pkt_detail line=4918 msg="vd-root received a packet(proto=17, 192.168.3.108:62887->208.91.112.52:53) from port3. "
id=20085 trace_id=12 func=resolve_ip_tuple_fast line=4982 msg="Find an existing session, id-0001059d, original direction"
id=20085 trace_id=12 func=__ip_session_run_tuple line=2893 msg="SNAT 192.168.3.108->192.168.132.50:62887"
id=20085 trace_id=12 func=__ip_session_run_tuple line=2944 msg="run helper-dns-udp(dir=original)"

I do notice in the below that the VM Guest has tried to reach the DNS set by Fortigate, it does not mention if it was successful or not below, Would it be possible for you to explain the 1st line below..

id=20085 trace_id=13 func=print_pkt_detail line=4918 msg="vd-root received a packet(proto=17, 192.168.3.108:50226->208.91.112.53:53) from port3. " id=20085 trace_id=13 func=resolve_ip_tuple_fast line=4982 msg="Find an existing session, id-0001060a, original direction" id=20085 trace_id=13 func=__ip_session_run_tuple line=2893 msg="SNAT 192.168.3.108->192.168.132.50:50226" id=20085 trace_id=13 func=__ip_session_run_tuple line=2944 msg="run helper-dns-udp(dir=original)" id=20085 trace_id=14 func=print_pkt_detail line=4918 msg="vd-root received a packet(proto=17, 192.168.3.108:50226->208.91.112.52:53) from port3. " id=20085 trace_id=14 func=resolve_ip_tuple_fast line=4982 msg="Find an existing session, id-000105fa, original direction" id=20085 trace_id=14 func=__ip_session_run_tuple line=2893 msg="SNAT 192.168.3.108->192.168.132.50:50226" id=20085 trace_id=14 func=__ip_session_run_tuple line=2944 msg="run helper-dns-udp(dir=original)" id=20085 trace_id=15 func=print_pkt_detail line=4918 msg="vd-root received a packet(proto=17, 192.168.3.108:58992->208.91.112.52:53) from port3. " id=20085 trace_id=15 func=init_ip_session_common line=5062 msg="allocate a new session-0001089e" id=20085 trace_id=15 func=vf_ip_route_input_common line=2583 msg="find a route: flag=04000000 gw-192.168.132.1 via port1" id=20085 trace_id=15 func=fw_forward_handler line=711 msg="Allowed by Policy-1: SNAT" id=20085 trace_id=15 func=__ip_session_run_tuple line=2893 msg="SNAT 192.168.3.108->192.168.132.50:58992" id=20085 trace_id=15 func=__ip_session_run_tuple line=2944 msg="run helper-dns-udp(dir=original)" Appreciate your help again..

huudAuthor

Explorer II

Sorry again, I have changed the IP of the WAN to 192.168.132.50 as I did a new setup, rest everything is the same..

huudAuthor

Explorer II

This is now resolved.

What happened was I was setting manual IP addresses of both the WAN port 1 and the static route gateway as IP address of laptop vmnet8 which is 192.168.132.1.

What I tried was let the DHCP assign the WAN port IP and also let the static route get the IP dynamically (this was an option in the static route only showing when I allow DHCP IP assignment to WAN port 1..

I saw that the dynamically assigned static route IP is 192.168.132.2 (my laptop vmnet8 IP is 192.168.132.1), now I'm just not understanding who is assigning this IP to the static route, if its the VMware DHCP then how or to what is it getting assigned to or is it just a thing between VMWare and Fortigate.

What I have noticed is that the DHCP IP of WAN is 192.168.132.152 and not 192.168.132.2 or 3 or 4 etc, I have tested this twice.

A tracert from the guest client VM

tracert 8.8.8.8

Tracing route to google-public-dns-a.google.com [8.8.8.8]
over a maximum of 30 hops:

  1   <1 ms   <1 ms   <1 ms 192.168.15.10
  2   <1 ms   <1 ms   <1 ms 192.168.132.2 >>> IP first assigned dynamically by fortigate, then I set the same IP manually and it works.
  3   22 ms   5 ms   6 ms 192.168.1.254
  4   6 ms   14 ms   14 ms 192.168.10.1
  5   26 ms   20 ms   21 ms 10.8.15.1
  6   *     22 ms   18 ms 89.19.65.170
  7   *     36 ms   25 ms 89.19.65.201
  8   37 ms   79 ms   16 ms 74.125.244.1
  9   15 ms   25 ms   17 ms 72.14.239.219
10   17 ms   20 ms   15 ms google-public-dns-a.google.com [8.8.8.8]

Trace complete.

Again thank you for all the help.

sw2090

SuperUser

take a look on your static routing on your FGT again:

your first static route made all internet traffic go to your laptop. Laptop had internet access you said but I suppose it doesn't do any routing for incoming traffic from outside it. Also it would have to do NAT in this case.

You needed to have a static (or non static) default route that goes to your FGT's WAN Interface. Then Internet Traffic goes the correct way. I guess setting the WAN to dynamic has overwritten that default route (or set a new one with lower prio/metric) with the correct settings.

huudAuthor

Explorer II

Appreciate the information.

Thank You

Sign up

Login with SSO

Login to the community

Login with SSO