New Member

Question

NO internet connection when using static ip ?

Forum|Forum|2 years ago
April 27, 2024
34 replies
10157 views

hello every one

i am wondering why internet connection not working in fortigate 70f when i config the wan port ip manually ??

i try to exec ping google.com but not resolved

but when i change to dhcp to take an ip from the tplink router ,everything works just fine and i am able to ping anything from CLI .

with static ip config

i try to add static route :

0.0.0.0 172.16.16.1 (tplink gateway)

i also added dns

8.8.8.8 (unreachable )

8.8.4.4 (unreachable )

i can ping the gateway only 17.16.16.1

------------------------

i need the internet only to setup VPN site to site NOT to provide internet access to the local workstations .

as i mentioned it works only if i use DHCP not static IP . as u know DHCP not a good choice for my case ,if anything happened like power loss or restarting, it will obtain a new WAN IP address and the other site will not be able to access the database .

FortiGate

mpeddalla

Staff

Hello @morana ,

Thank you for contacting the Fortinet Forum portal.

Whatever mode you use make sure the arp entry is present in the arp table of the FortiGate to ensure the next hop route.

-Did you verify with the ISP the same information as to why the manual configuration is not working as expected?

Please refer below article and make sure the steps:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Changing-Internet-Service-Providers/ta-p/190395

Best regards,

Manasa.

If you feel the above steps helped resolve the issue, mark the reply as solved so that other customers can get it easily while searching for similar scenarios.

moranaAuthor

New Member

the arp table shows me the ip 172.16.16.1 with interface wan2 -- fine

no problem with isp . i can configure static ip for any device like my laptop .except forigate .

i have 2 wan connections port wan1 is fine .

port wan2 not working static .

is it related to firewall policy ??

if so ,how can i add a rule firewall policy for wan 2 to get internet access for only fortigate system , i do not want the local machines clients that connected to fortigate gateway to be provided with internet .?

AEK

SuperUser

Hi Morana

Firewall policy doesn't have control on firewall generated traffic (like ping from FG to WAN). I think you have another default gateway in your routing table that has lower priority or lower distance than a manually added static route. You can check with command:

get router info routing-table all

If this is the case then you need to manage your default gateways depending on your requirement, e.g.: if that route is not needed then just remove it, or if is a WAN gateway you may use SD-WAN or policy routes, etc...

AEK

moranaAuthor

New Member

wan1 is used as service from ISP provider for VOIP only and is configured static 16.16.16.1

now i added wan2 (port 2 connected directly to tplink router with new ip :192.168.1.2 ) just for internet connection to use vpn ipsec site to site . static not working for internet connection but DHCP works the problem is even with DHCP the ipsec tunnel not up for both sites .

all what i need is to make the vpn site to site working (fortigate to fortigate ) i tried every possible but not success .

site 1 (dhcp = internet ok )

site 2(static ip= internet ok)

but there is no connection between tunnels !! is it because DHCP ?

i mean in order to start ipsec site to site .static ip is required for both sites ?

one more thing

there is deafult gateway in static route :

0000/0 0000

is this required or should remove it ?

moranaAuthor

New Member

sory u mean u want DHCP interface parameters ?

AEK

SuperUser

I mean the entries shown by the following command:

get router info routing-table all

AEK

moranaAuthor

New Member

Routing table for VRF=0
S* 0.0.0.0/0 [5/0] via 192.168.1.1, wan2, [1/0]
C 16.16.16.0/24 is directly connected, wan1
C 192.168.1.0/24 is directly connected, wan2
C 192.168.10.0/24 is directly connected, internal
S 192.168.20.0/24 [10/0] via 16.16.16.2, wan1, [1/0]
S 192.168.30.0/24 [10/0] via 16.16.16.3, wan1, [1/0]
S 192.168.40.0/24 [10/0] via 16.16.16.4, wan1, [1/0]
S 192.168.50.0/24 [254/0] is a summary, Null, [1/0] <<------- this 1 created by site to site for the new subnet office

moranaAuthor

New Member

Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default

Routing table for VRF=0
S* 0.0.0.0/0 [5/0] via 192.168.1.1, wan2, [1/0]
C 16.16.16.0/24 is directly connected, wan1
C 192.168.1.0/24 is directly connected, wan2
C 192.168.10.0/24 is directly connected, internal
S 192.168.20.0/24 [10/0] via 16.16.16.2, wan1, [1/0]
S 192.168.30.0/24 [10/0] via 10.10.10.3, wan1, [1/0]
S 192.168.40.0/24 [10/0] via 10.10.10.4, wan1, [1/0]
S 192.168.50.0/24 [254/0] is a summary, Null, [1/0] <<----------

the last line is the new subnet remote office ,that i am trying to reach for site to site

moranaAuthor

New Member

some1 told me to use dynamic ip with ddns in order to make it work but, fortiddns.com or any dns server in the list not working cannot ping from CLI to any dns servers even with success domain created : example.branch.fortiddns.com

atakannatak

Explorer

Hello @morana,

@Toshi_Esumi has already explained all possible scenarios to match your situation. However, I would like to add a few more points:

1- Firstly, you need to configure Port Address Translation (PAT) on your TP-Link modem because the remote site reaches your firewall through this modem. You must redirect UDP port 4500 to your firewall; otherwise, the IPSec tunnel will not establish.

2- Secondly, you mentioned that your sites do not have a public address directly. Your firewall is behind your TP-Link modem, which means your public address does not belong to you and will change continuously. To handle this unstable public address condition, you can configure a dial-up IPSec instead of the DDNS solution.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-a-FortiGate-as-IPsec-VPN-Dial-Up/ta-p/197552

In addition, please follow these steps to ensure your routing and other network components work as expected:

1- Add a specific route such as 9.9.9.9/32 to use your WAN2 port.

2- Try pinging the first next-hop, which is the TP-Link modem's interface IP address. If it fails, ensure connectivity between the TP-Link modem and the firewall.

3- If successful, try pinging 9.9.9.9. If it fails, please check the TP-Link modem's configuration, as step 2 indicated that packets already reached the TP-Link modem.

4- If successful, everything seems good for internet connection via this WAN2.

5- At this point, consider @Toshi_Esumi ' s and the above feedback. Run the below troubleshoot commands, and the please share the community of this output.

--First CLI Screen--

exec traceroute-options source a.b.c.d (it's your wan2 ip address)
exec traceroute x.y.z.t (remote peer ip address)
get router info routing table details x.y.z.t (remote peer ip address)

dia vpn ike log-filter dst-addr4 x.y.z.t

dia de app ike -1
dia de en

--Second CLI Screen--

diag sniff packet any "host x.y.z.t" 4 0 a

--Third CLI Screen--

You must be ensure the what's the source and the destination before the run below commands. For example; in the above redirection if you try to ping 9.9.9.9 and your source ip is a.b.c.d then the commands must like that. Please run this and the second screen commands during the Step 3 which means pinging the 9.9.9.9 situation. I asked because your firewall rule might not have been correctly configured, possibly due to mistakenly enabling NAT.

diagnose debug disable
diagnose debug flow trace stop
diagnose debug flow filter clear
diagnose debug reset
diag debug console timestamp enable
diagnose debug flow filter saddr a.b.c.d

diagnose debug flow filter daddr 9.9.9.9
diagnose debug flow show function-name enable
diagnose debug flow trace start 9999
diagnose debug enable

Best Regards.

moranaAuthor

New Member

thanks for reply , i will try that for both tplinks home router for site A and site B

but as i mentioned site A fortigate no internet connection when using manually static ip only can get internet when change it to DHCP .and site B fortigate internet works fine if configure it as static ip !!

thank u guys all , i appreciate your effort to help me ,and i will try all ur suggestions

Toshi_Esumi

SuperUser

That's probably because Site-B doesn't have two internet circuits on both wan1 and wan2.

What is the public IP at the Site-B when someone on-site search "What is my IP" at Google? That's the IP you need to set a staitc route toward wan2 and the IPsec phase1 is connecting to. Private IPs like 192.168.x.x are not reachable over the internet.

Toshi

moranaAuthor

New Member

i managed to get site B fortigate ddns work and i can access it form outside the network by following your instructions regarding the public ip and the adsl modem .

in site B tplink modem i changed it to bridge then i reconfigured site B fortigatw wan to PPPOE and created domain dns and worked very well .

now i site A (HQ) i changed the internet connection from dsl to Fiber connection, but problem still there it only accepts DHCP . i kept it as DHCP no problem if there is an internet connection .

and created domain DDNS and seems fine : when i ping the DDNS domain name from cli it pings ok .when i try to ping the site B domain DDNS : it shows me the remote site IP but all packet loss . something is blocking DDNS .

all servers and sites can be ping but ddns cannot for site A.

Toshi_Esumi

SuperUser

Have you found out the public IP viewed from the outside at Site-B? Was it the same with the IP the TP-Link pulled from the ISP? If they're different no VPN might establish if Site-A's TPLink's IP is not static, like below:
https://community.fortinet.com/t5/Support-Forum/IPSec-Site-to-Site-VPN-between-two-carrier-grade-natted-Sites/m-p/221822

In any case, after many of us trying to figure this out, none of us could get enough information to determine mainly because we don't have access to your FGT and can't see what TP-Link has including traceroute result from both ends, and wasting your time as the result.

I think it's better you open a ticket at TAC then get a TAC person looked at both sides to determine what can/need to be done in your situation.

Toshi

moranaAuthor

New Member

NOW -this config without PPPoe . obtained from TPLink router DHCP with fortiguard DDNS disabled or Enabled .same result ..

yah it is the same :

what is my ip : XXX.XX.94.103

in fortigate info : XXX.XX.94.103

when i put the above ip in in the browser it opens tplink login page .

ANYWAY THNAKS will go ahead with TAC

Sign up

Login with SSO

Login to the community

Login with SSO