New Member

Question

How do i set a IP pool address as a local IP address in 7.2.10 Release?

Forum|Forum|1 year ago
November 5, 2024
13 replies
3833 views

How do i set a IP Pool address in FortiOS 7.2.10 as a local address in a 120G?

120G considers them as a external address.

Thanks in advance

FortiGate

AEK

SuperUser

~~I'm not sure if I understand well your requirement but I guess you mean enable ARP reply in the VIP.~~

config firewall vip
  edit VIP1
    set arp-reply enable
  next
end

Edit: Mea culpa. I thought it was about VIP.

AEK

Toshi_Esumi

SuperUser

Share us the GUI screen shot or CLI output why you think "120G considers them as a external address".

Toshi

jbaAuthor

New Member

I have the 120G and 80F, but with a factoryreset and a simple setup.
Both with 7.2.10 and both with a IP Pool Address and ARP enabled.

80F uses WAN1 with DHCP
120G uses port2 as WAN1 with DHCP
IP Pool at 80F and 120G is the same for testing (Head Office, Branch Office)

FortiGate-80F (SNAT-IP 172.17.5.0/24) # show config firewall ippool     edit "SNAT-IP 172.17.5.0/24"         set startip 172.17.5.1         set endip 172.17.5.1     next end

FortiGate-120G (SNAT-IP 172.17.5.0/24) # show config firewall ippool     edit "SNAT-IP 172.17.5.0/24"         set startip 172.17.5.1         set endip 172.17.5.1     next end

Screenshot from 120G

2024-11-05 18_18_28-FortiGate - FortiGate-120G-01.jpg

And a single f/w-rule

FortiGate-80F (1) # show config firewall policy     edit 1         set name "Internet"         set uuid xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx         set srcintf "internal" "wifi.fortilink"         set dstintf "virtual-wan-link"         set action accept         set srcaddr "all"         set dstaddr "all"         set schedule "always"         set service "ALL"         set logtraffic all         set nat enable     next end

From a second shell, i do exec ping 172.17.5.1

FortiGate-120G # diagnose sniffer packet any 'host 172.17.5.1' 4 filters=[host 172.17.5.1] 2.693988 port2 out 93.241.42.222 -> 172.17.5.1: icmp: echo request 3.694028 port2 out 93.241.42.222 -> 172.17.5.1: icmp: echo request  FortiGate-80F # diagnose sniffer packet any 'host 172.17.5.1' 4 filters=[host 172.17.5.1] 13.410881 root out 172.17.5.1 -> 172.17.5.1: icmp: echo request 13.410891 root in 172.17.5.1 -> 172.17.5.1: icmp: echo request

120G sends icmp to the internet and 80F to the local IP Pool.

So, i need to tell the 120G that this IP Pool is local address.

Toshi_Esumi

SuperUser

IP pools are used in policies for SNAT. The traffic to use the SNAT needs to come from the source interface defined in the policy. Pinging from inside the FGT wouldn't use an ippool. Try ping from a device connected to the source interface.

Toshi

jbaAuthor

New Member

Thanks, but this looks like an IP Pool for DHCP ...
I need a IP Pool for SNAT

Toshi_Esumi

SuperUser

No. This is the way for IP pool to work for SNAT. DHCP's pools are configured under

config system dhcp server

Not in a policy.

Toshi

jbaAuthor

New Member

all tested at 80G

Now, i created a VLAN5 172.17.5.0/24 with interface IP 172.17.5.1.
I created a new rule 'VLAN5', allow traffic from internal to VLAN5 with source/destination and can ping the VLAN5 interface 172.17.5.1 from internal if enabled.

Now i create a SNAP IP Pool 172.17.5.2 and use this as a NAT / SNAT IP in rule 'VLAN5'.

From the earlier information, I should be able to reach the IP pool address 172.17.5.2 from the internal lan via icmp.

But that doesn't work either.

Toshi_Esumi

SuperUser

I was thinking I would have to test it myself to confirm. But I found an old discussion about "pining ippool IP".
https://community.fortinet.com/t5/Support-Forum/ping-restriction-to-IP/td-p/22013

ippool IP is generally not attached to any interface (just SNAT IP) you wouldn't be able to ping unless that specific IP is mapped to something more tangible, like VIPed (mapped) to a physical device with a different policy on opposite direction.

Tosh

jbaAuthor

New Member

Thanks for the information.

Currently only the 80F model replies on a internal ping to a IP Pool address and the 120g doesn´t.

Yesterday i configured a VLAN with the IP Range i need and added a second IP address to this VLAN. From the other side of the s2s tunnel i am able to ping this second IP address and monitor the tunnel. Even if ithe VLAN is not connected to any interface right now.

This seems to work fine.

Sign up

Login with SSO

Login to the community

Login with SSO