Skip to main content
Izanagi
Izanagi
Visitor III
February 10, 2023
Solved

I want to know if it is possible to ping internet from lan interface on fortigate

  • February 10, 2023
  • 2 replies
  • 1765 views

Hi,

Lets say i have wan1 and internal1 as interfaces where wan1 is connected to internet and internal1 is connected to a laptop.

We have a default route because wan1 is set as DHCP client and we also have a policy to forward traffic from lan to internet (internal1 -> wan1).

If i ping internet from laptop i have connectivity, but if i try to ping internet from interface internal1 on fortinet i have no reply. Why is that?

I see in debug that traffic is not initiated from LAN name, but from "local". Is there a possibility to have reply even if i ping from internal1?

Thank you

Best answer by Toshi_Esumi

That's because if you are IN your FGT pinging from there, regardless what souce IP/interface you specify with the "ping-option source", it would never follow the policy for the ingress-interface to egress-interface. It would just go out through the interface your route is pointing to with the source-IP (in your case) you specify. So no SNAT is applied in your policy. And the ping destination over the internet doesn't know how to route back even if it's not simply dropped because of the private IP for the returning IP.

 

Toshi

2 replies

abelio
SuperUser
abelio
SuperUser
February 10, 2023

Hi

Indeed.  Use   ping-options source  option from CLI command.

I.e:
# exec ping-options source <here_your_interface_you_want)to-ping-from>
# exec ping <IP/host of interest>

There're more options to play with:


# exec ping-options  ?

adaptive-ping Adaptive ping <enable|disable>.
data-size Integer value to specify datagram size in bytes.
df-bit Set DF bit in IP header <yes | no>.
interface Auto | <outgoing interface>.
interval Integer value to specify seconds between two pings.
pattern Hex format of pattern, e.g. 00ffaabb.
repeat-count Integer value to specify how many times to repeat PING.
reset Reset settings.
source Auto | <source interface IP>.
timeout Integer value to specify timeout in seconds.
tos IP type-of-service option.
ttl Integer value to specify time-to-live.
use-sdwan Use SD-WAN rules to get output interface <yes | no>.
validate-reply Validate reply data <yes | no>.
view-settings View the current settings for PING option.



 

Toshi_Esumi
SuperUser
Toshi_EsumiAnswer
SuperUser
February 10, 2023

That's because if you are IN your FGT pinging from there, regardless what souce IP/interface you specify with the "ping-option source", it would never follow the policy for the ingress-interface to egress-interface. It would just go out through the interface your route is pointing to with the source-IP (in your case) you specify. So no SNAT is applied in your policy. And the ping destination over the internet doesn't know how to route back even if it's not simply dropped because of the private IP for the returning IP.

 

Toshi

    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!