Skip to main content
sebastan_bach
sebastan_bach
New Member
December 28, 2016
Solved

Issues with setting up Fortigate VM

  • December 28, 2016
  • 2 replies
  • 21428 views

Hi,

 

I have installed fortigate VM 64 bit running VMware. I have enabled 2 interfaces WAN & LAN & enabled management access on both the interfaces. I have assigned static IP address to both the interfaces. The WAN interface VM NIC mode is set to Nat & the Lan interface of the fortigate VM NIC is set to host mode. From the fortigate firewall I am able to ping the internet & the lan guest VM as well. But i am not able to access internet from the internal guest VM though I have a policy with nat enabled & allowed all services. Any guesses or ideas to get this working would be really helpful.

 

Regards

 

Sebastan

    Best answer by neonbit

    Hi Sebastan, you don't need a dedicated management port, enabling management on an interface would be enough.

     

    Sounds a little weird that your internal pc cant ping through the firewall since a) firewall can ping the internet, b) pc can ping firewall lan interface c) allow all policy has nat enabled.

     

    My suspicion is that there is a problem with the policy (are you referencing the correct interfaces?).

     

    Ultimately the best way to test this out is to do a diag debug from the FortiGate CLI to confirm exactly where these packets are going.

     

    Firstly make sure you are not pinging 8.8.4.4. Connect to the FortiGate CLI then type the following commands:

     

    diag debug flow filter daddr 8.8.4.4

    diag debug flow show console enable

    diag debug enable

    diag debug flow trace start 3

     

    Once this is done start pinging 8.8.4.4 from your internal PC. Observe the FortiGate CLI output, it should confirm two key things 1) what route/interface the packets match & 2) what policy it hit.

     

     

    2 replies

    MikePruett
    MikePruett
    New Member
    December 28, 2016

    Is the VM on the proper switch with the proper IP/gateway etc? I would check to see if the guest VM can even ping the inside interface of the Gate (be sure to enable ping on the appropriate interface). If you can't, chances are it's a VM ware issue and not a FortiGate issue.

    sebastan_bach
    sebastan_bachAuthor
    New Member
    December 29, 2016

    Hi Mike,

     

    Do we need to have a dedicated management interface ?. I have enabled management functions on both the firewall interfaces.

     

    My Inside host can ping the fortigate lan interface & from the fortigate firewall I can ping the global DNS servers of 8.8.8.8 & 8.8.4.4 as well. I have a default route on the Firewall as well.

     

    But the issue is that inside host cannot ping the internet even with a allow all firewall policy in place.

     

    What is the best way to troubleshoot any suggestions please

     

    Regards

     

    Sebastan

    neonbit
    neonbitAnswer
    New Member
    December 29, 2016

    Hi Sebastan, you don't need a dedicated management port, enabling management on an interface would be enough.

     

    Sounds a little weird that your internal pc cant ping through the firewall since a) firewall can ping the internet, b) pc can ping firewall lan interface c) allow all policy has nat enabled.

     

    My suspicion is that there is a problem with the policy (are you referencing the correct interfaces?).

     

    Ultimately the best way to test this out is to do a diag debug from the FortiGate CLI to confirm exactly where these packets are going.

     

    Firstly make sure you are not pinging 8.8.4.4. Connect to the FortiGate CLI then type the following commands:

     

    diag debug flow filter daddr 8.8.4.4

    diag debug flow show console enable

    diag debug enable

    diag debug flow trace start 3

     

    Once this is done start pinging 8.8.4.4 from your internal PC. Observe the FortiGate CLI output, it should confirm two key things 1) what route/interface the packets match & 2) what policy it hit.

     

     

    jamesc
    jamesc
    New Member
    May 10, 2019

    i have same issue

     

    same setup and results of diag

    Terms & ConditionsAccessibility statement