HQ-2 can't reach HQ active directory

Question

hello everybody
am facing strange issue where I can't ping from our new site lets name it HQ-2 I have configured firewall policy and everything we have an ipsec tunnel between main site HQ and new site HQ-2 I have vlan for MGMNT other device in same vlan they can reach the AD via the ip sec tunnel such as switches but still my firewall can't ping when I run the command Diagnose sniffer packet to see whats going on it seems the firewall is trying to ping the AD via the dmz interface which has the ip 10.10.10.1 nothing is connected to this interface I have tried to use policy route but still the same issue any advice what could be the issue here ?
thanks in advance

MohammedAlrawi · Accepted Answer

Hi
First of all apologies for my bad English as it is not my first language.

as for the problem above the issue it turns out to be that the fortigate firewall is pinging from another interface not through the ipsec tunnel or lets say not through the Management IP so all you need is to go through CLI to edit LDAP user config :

FortiGate-101F # config user ldap
FortiGate-101F (ldap) # edit <name of LDAP>

set source-ip "192.168.150.1"

thats all you need then you can finish everything

also the problem that I was trying to ping the Active Directory from firewall and I was not able to reach it even tho the switches were in the same VLAN and they can reach the AD
you have to ping with ping-option source <MGMNT IP>.

dingjerry_FTNT · Answer

Hi @MohammedAlrawi ,

1) First of all, if you can use the punctuation correctly, it will be soooooooo easy for us to understand.

2) Disable Policy Routes. Then capture and share the outputs of diag sniffer commands on both peers and routing tables on both peers.

3) If you can provide the FGT config and/or the network diagram, that would be better.

Sign up

Login with SSO

Login to the community

Login with SSO