New Member

Question

Ping out no DNS out?

Forum|Forum|15 years ago
July 6, 2011
15 replies
8254 views

Ive seen this issue a couple times, where users behind a Fortigate can ping, but suddenly cannot surf web as if DNS is not resolving. I know DNS is fine, and the Fortigate is reachable remotely. Once the Fortigate is recycled, browsing is fine. I' m assuming it' s a proxy problem, any ideas?

abelio

SuperUser

Hi, it' s very difficult answer or help if posted in such terms. Please, provide your FTG' s relevant settings , even a network diagram could helps. regards

jtfinleyAuthor

New Member

it' s very difficult answer or help if posted in such terms. Please, provide your FTG' s relevant settings , even a network diagram could helps.

There are (3) PC' s behind the Fortigate 30b. This has happened twice in 3 days. I have two fw policies. One for HTTP&HTTPS which UTM is defined for blocking malware/greyware. And a Second policy for everything else...that' s it.

ddskier

New Member

Double check your application control logs. We have seen that sometime DNS requests are being blocked because the application control or IPS thinks it' s an attack.

jtfinleyAuthor

New Member

Double check your application control logs. We have seen that sometime DNS requests are being blocked because the application control or IPS thinks it' s an attack.

I don' t have any IPS settings enabled.

emnoc

New Member

I had a FWF30 and we had the exact same thing. I believe this is somehting else related but to the firewall or hardware. In our cases, it was the same 2-4 machines, you can ping out but for some reason hosts can' t resolve any dns-names. I never open a ticket with fortigate, since I gave that unit away to a an associate of mine that had the exact same problems. he too like me, never investigated any time in trying to figure it out.

Kenundrum

New Member

Are users set to use the fortigate as a dns server? I am beginning to notice a similar problem with some of my locations as well. With the 3.x firmwares, I noticed an issue with dns not resolving after the unit had been active for about 2 months without reboot. I' ve got 4.1.8 and 4.2.6 in all my locations and I' m noticing this problem again but only after about a day or two of uptime. If users set dns to an external server, dns seems to work fine, but the fortigate would stop forwarding dns requests sent to it directly. I haven' t been able to pinpoint more details yet, the problem only began to pop up in a few locations yesterday. I' ve been using the 4.1.8 since december and started updating some sites to 4.2.6 when it came out a short time ago- strangely no problems of this nature until yesterday.

jtfinleyAuthor

New Member

Are users set to use the Fortigate as a dns server? I am beginning to notice a similar problem with some of my locations as well.

No, I am using two OPEN type DNS services such as, 208.67.222.222 & 8.8.8.8. One thing I noticed on a type of cablemodem specifically the Motorola Surfboard 6120 on two separate cable carriers (Comcast & TimeWarner). If I administratively take down the WAN interface and bring it back up, it starts working again?

Kenundrum

New Member

How about traffic shaping? After further prodding, the devices that are having dns resolution problems also have traffic shaping enabled in their internet access rules. Surprisingly other devices behind the same fortigate that are not subject to traffic shaping do not have any problems at the exact same time. I too have no IPS enabled on the devices that experiencing problems.

A

Anonymous_User

Esteemed Contributor III

Same issues with FG 60 models. If I uncheck " protection profiles" under the policy that allows users out to the internet, users will be able to surf. I do not want to " Uncheck Protection Profiles" so I resboot and all works for a day or 2 and then Internet breaks again. Any ideas ?

jtfinleyAuthor

New Member

Same issues with FG 60 models. If I uncheck " protection profiles" under the policy that allows users out to the internet, users will be able to surf. I do not want to " Uncheck Protection Profiles" so I resboot and all works for a day or 2 and then Internet breaks again.

Do you have any AV or IPS blocking if something is triggered? I had something like this. In my case, there are no IPS settings in my policy that are enabled.

A

Anonymous_User

Esteemed Contributor III

None that I can see, it has happened on different FG firewalls at different times. Users cant access internet, reboot firewall fixes issue for a couple of weeks and it happens again.

jtfinleyAuthor

New Member

None that I can see, it has happened on different FG firewalls at different times. Users cant access internet, reboot firewall fixes issue for a couple of weeks and it happens again.

Ive had this happen on two Fortigates of different models, and it' s consistent to the same environment meaning, I only have this issue at two places not all over.

A

Anonymous_User

Esteemed Contributor III

It is becoming ridiculous and I am surprised Fortinet has no fix out for that.

jtfinleyAuthor

New Member

Following up on this one. We' ve had (2) instances where a Fortigate WIFI 30 & 80c would literally go offline. The INTERNAL interface is not pingable nor the WAN, however, connected to the console, I can ping various hosts on the Internet, but not internally. I set my ping-option sourced from internal IP and executing a ping from Fortigate fails. This one has me stumped. Nothing has changed in the configs for weeks. Both were running MR3

jtfinleyAuthor

New Member

Another follow up here. Previously stated there were (2) instances happening, I have eliminated one. It turned out to be an issue with the managed ISP filtering inbound somehow. The other item, we downgraded/firmware flash to MR2p8. No issues since. --Joe

Sign up

Login with SSO

Login to the community

Login with SSO