Skip to main content
Advntrhike
New Member
July 17, 2017
Solved

No internet access for odd IP addresses

  • July 17, 2017
  • 5 replies
  • 11165 views

That might sound like I need to verify IP addresses, but that is not the case.  I have an interesting problem that I need to address and was wondering if anyone had any insight or experience with this issue.  We recently purchased a 100e to replace an old, and dying, ASA5510.  The initial setup went smoothly and all traffic was flowing as expected. 

 

I had to add a second, separate but similar, network for SFTP traffic.  The IP scheme was close but not an exact match.  This part also went smoothly.

 

I have recently been tasked with configuring a test network for training purposes.  I went about the same process as I did adding in the second network, but ran into a small issue.  Even numbered IP addresses can hit the internet, but odd numbered IP addresses are stopped at the firewall.  For simplicity sake, I opened the ports up to all traffic but still get blocked when using an IP address that has a final octet that ends in an odd number.  For example, X.X.X.132 will work, but X.X.X.45 will not work.  All IP addresses can ping the firewall and internal communication is fine.

 

Any thoughts or insight would be appreciated.

Best answer by bommi

Hi,

 

just run an "debug flow" to show us the processing of your traffic:

 

http://kb.fortinet.com/kb/documentLink.do?externalID=FD33882

 

Please collect an debug flow of an even and one debug flow of an odd ip-address.

 

Regards

bommi

5 replies

bommi
bommiAnswer
New Member
July 17, 2017

Hi,

 

just run an "debug flow" to show us the processing of your traffic:

 

http://kb.fortinet.com/kb/documentLink.do?externalID=FD33882

 

Please collect an debug flow of an even and one debug flow of an odd ip-address.

 

Regards

bommi

ede_pfau
SuperUser
SuperUser
July 18, 2017

That sounds like you have WAN LLB configured.

You can additionally to "debug flow" use the internal sniffer to see where the traffic stops:

diag deb en

diag sniffer packet any 'icmp and host a.b.c.11' 4 0 a

 

You would expect to see the packet on 'internal' and then on 'wan1'. Repeat with an even-numbered host.

Advntrhike
New Member
July 18, 2017

Thank you both for the recommendations!  For some reason all odd numbered IPs were attempting to route through my secondary WAN interface rather than the primary.  Turning that off instantly corrected the problem, just not necessarily with the desired configuration.

Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT