Skip to main content
Mossab
Mossab
New Member
January 22, 2015
Question

No internet connection

  • January 22, 2015
  • 2 replies
  • 72506 views

Dears,

 

I have fortigate 40c, it is deployed behind a modem connected to internet.

it was with release 5.0, and it has a policy to route internal interface to wan1.

it was working very well.

After I upgraded it to v 5.2, the users connected to internal interface have lost the connectivity to internet.

i didn't change any configuration, just upgrade.

i reviewed the configuration, but seems nothing incorrect.

the device itself has internet, as i can ping to internet websites from its CLI.

is it DNS issue, and how can i solve, please advise.

 

BR

    2 replies

    Dave_Hall
    Dave_Hall
    New Member
    January 22, 2015

    So what have you done to troubleshoot this from the client side?  Are you able to ping the default gw address, a place on the Internet by FQDN and IP address?  Have you tried pinging Google's DNS? (8.8.8.8)?  Are you able to ping a client device from the 40C?

     

    Does the count column on the firewall policy list show any traffic on any of the policies?

     

    If you are using FortiGuard web filtering did you check to see if the 40C can connect/access the FortiGuard servers?

    Mossab
    MossabAuthor
    New Member
    January 23, 2015

    Thanks for reply.

    to troubleshoot this from the client side, i was able to ping the IP of internal interface. but not able to ping 8.8.8.8 or any FQDN.

    i can ping a client device. i have AP connected to internal interface. and through it i'm getting ip from DHCP of internal interface.

    i can browse FG management interface, using internal interface IP or WAN1 IP.

    Yes, the column of the policy shows traffic.

    I don't have FortiGuard.

    when i troubleshoot the connectivity from Internet explorer, i'm getting a message that your PC is not able to communicate with the DNS.while from FG itself i can access internet.

     

    Iescudero
    Iescudero
    New Member
    January 23, 2015

    Hi! doesnt seems a DNS issue, because you can't ping 8.8.8.8 from a workstation. i am right?

    you have two options:

    First one, check all your configuration and see what is wrong...and you can be a week without Internet.

    Second choice (i go with this one), you can troubleshoot this issue doing this:

     

    1) in the workstation (just for the example, lets we say the ip of the workstation is teh 192.168.1.100), open a cmd a do a ping 8.8.8.8 -t

     

    2) In fortigate, open a CLI and write this commands:

     

    diagnose debug disable

    diagnose debug reset

    diagnose debug flow filter saddr 192.168.1.100

    diagnose debug flow filter daddr 8.8.8.8

    diagnose debug flow filter proto 1

    diagnose debug flow show trace start 100

    diagnose debug enable

     

    and voila! the fortigate will say to you what is doing with your traffic, if you dont understand it, please copy and paste the ten or maybe fifteen lines from the debug and we will continue with the troubleshoot.

     

    Bye!

     

    rwpatterson
    rwpatterson
    New Member
    January 23, 2015

    See the below post for a probable solution.

     

    https://forum.fortinet.com/tm.aspx?m=99159

    Mossab
    MossabAuthor
    New Member
    January 25, 2015

    Dear all,

    Many Thanks for your support.

    Issue has been solved.

     

     

    I just edited the config file using notepad++ then searched for "config firewall service custom"

    and under it I added one line: set protocol-number 0

     

    config firewall service custom     edit "ALL"         set category "General"         set protocol IP         set protocol-number 0              "newly added"     next

     

    then I saved and uploaded the file again. after that I got everything working like before.

    thank you every body and especially Mr.Jan Scholten who posted this solution, and Mr.rwpatterson who mentioned the link of that case.

     

     

    Regards,

    Terms & ConditionsAccessibility statement