Please help. Strangest thing ever...

Forum|Forum|4 years ago
November 22, 2021
3 replies
10239 views

Hi all,

I have a LAN connected to the internet using a FortiGate 60D.

Clients gets an IP Address from DHCP on the the scope of 192.168.1.101-130.

When a client gets an odd ip (ex. 192.168.1.101, 192.168.1.103, 192.168.1.105, etc. ....) they can connect to the internet without any problem.

When a client gets an even ip (ex. 192.168.1.102, 192.168.1.104, 192.168.1.106, etc. ...) they can NOT connect to the internet. their DHCP lease looks fine. they get a default gateway and all other configuration and they can access the LAN but for some reason the FortiGate blocks them from going on the Internet. They can ping the default gateway but not any hop behind it.

As a temporary solution I excluded all even numbers from the scope.

Any ideas of what can cause this behavior?

FortiGate

Best answer by GDiFi

It sounds like you have load balancing turned on. The traffic is being load balanced between a good interface and one that you do not intend for it to use. This issue was seen by another community member and they found they had their secondary WAN interface setup but was not usable.

https://community.fortinet.com/t5/Fortinet-Forum/No-internet-access-for-odd-IP-addresses/m-p/79209?m=150804

Markus_M

Staff & Editor

Hi ShahafCZ,

Crosscheck whether the even IPs show the same behavior if you statically assign such IP.

Then ping an external source, if that also fails do a policy lookup, CLI preferred to see what is happening.

diag debug console timestamp enable
diag debug flow filter proto 1
diag debug flow filter addr <dst addr>
diag debug flow show iprope enable
diag debug enable
diag debug flow trace start 4

It will trace 4 packets of ICMP to <dst addr> and the first fresh session will show information about source, destination interface for the routing decision as well as a policy match. Do a fresh ping to the destination and see if those lines make sense to you.

Best regards,

Markus

ShahafCZAuthor

New Member

Thanks Markus.

Statically assigned ip acts the same.

Security Policy allows all the network 192.168.1.0 access the internet regardless the client specific ip.

I will try the diag CLI and report back.

Cheers.

GDiFiAnswer

Staff

It sounds like you have load balancing turned on. The traffic is being load balanced between a good interface and one that you do not intend for it to use. This issue was seen by another community member and they found they had their secondary WAN interface setup but was not usable.

https://community.fortinet.com/t5/Fortinet-Forum/No-internet-access-for-odd-IP-addresses/m-p/79209?m=150804