Policy LAN-to-LAN does not work

theG wrote:

Hi Daniel,

 

I'd look at using policy routes. You can then set your source addresses and destination addresses and select which port it should go out...

 

In the GUI...go to router>static>policy route. You'll see that you can select your incoming and outgoing interfaces with addresses. I'd leave the gateway address as is as you routing internally.

 

Goodluck

I don't see a reason why we have to use policy route. Normal routing should work.

Post the routing table from routing monitor and policies.

Also run the flow debug to check why traffic is not working:

diag debug reset

diag debug disable

diag debug enable

diag debug flow filter proto 1

diag debug flow show console enable

diag debug console timestamp enable

diag debug flow trace start 20

Start the ping from networks which are not working and once you have done the ping from all the affected network, disable the debug:

diag debug disable

Post the output.

theG wrote:

Just a quick question....you have created firewall policies to allow traffic between the interfaces right?

yes I do...

emnoc wrote:

I also 2nd the diag debug flow but also ensure if your using DHCP dynamic that you gave the right next-hop gateway out to your clients in the lans that don't work. But it seems like your problem are all 802.1q tagged subinterfaces so I'm guessing you should start at layer2. So have you ensured these are are correct configured in the layer2 setup and switch?

 

Can a host in the vlanXXX  ping the  fortigate L3 interface address in vlanXXX ( ensure allowacces  ping is enabled )?

 

Can you source a ping from  the fgt using the L3 subinterface address on vlanXXX and ping the outh lans or private/public ip

 

e.g

 

 execute ping-option source x.x.x.x

 execute ping  y.y.y.y ( with y.y.y.y being an address on internet or another interface )

 

Hi,

Yes, I am using DHCP for wifi clients. And create some vlans in port34, each vlan has its ip address act as gateway for the lan.

I can't get the result from:

 execute ping-option source 172.27.25.1

 execute ping  8.8.8.8 ( with y.y.y.y being an address on internet or another interface )

BUT my clients on that subnet can access internet normally, just cannot access to port22 and port23..

I have a good news, from now I can traceroute to subnet 103.x.x.0/25 lay on port22 and also ping.

for the other port23, its 172.27.18.0/24 still cannot reach from vlans in port34..

regards,

Daniel

ashukla wrote:

2015-02-19 05:49:38 id=20085 trace_id=281 func=print_pkt_detail line=4373 msg="vd-root received a packet(proto=1, 172.27.25.81:1->172.27.18.102:8) from vlan_26_puskom. code=8, type=0, id=1, seq=3188." 2015-02-19 05:49:38 id=20085 trace_id=281 func=init_ip_session_common line=4522 msg="allocate a new session-006986f1" 2015-02-19 05:49:38 id=20085 trace_id=281 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-172.27.18.102 via vlan_19_server" 2015-02-19 05:49:38 id=20085 trace_id=281 func=fw_forward_handler line=545 msg="Denied by forward policy check (policy 0)"

 

If this is the packet than check the following:

1)Do you have policy between vlan_26_puskom and vlan_19_server?

2) Is the service set to All (check if all has protocol any, not only tcp)

3) Is the incoming and outgoing interface correct as per design

Hi Ashukla,

I'm sorry forgot to change the policy. Last night I change the port type from physical type (port23) become vlan type (vlan_19_server) on port23, but not change the policy. Now, I can reach those area (vlan_19_server, servers in 172.27.18.0/24).

But, I still have question about policy "from ANY to port22". Since first time create this policy, it does not work. When tracing to servers in this area (connected to port22), always redirect to internet (port26). But last night when I come to site and test the connection.., it works.

Thank you for your response..., also thanks to all of you that response to my case.

By now, my cases are solve.

Regards,

Daniel

teri.ireng wrote:

Hi,

I have problem accessing port22, some IP address accessible but some can not reach. I can ping from FGT's interface to the servers. But only some IP response from other side (LAN). Here is the capture from debug..

 

2015-02-20 19:15:29 id=20085 trace_id=453 func=print_pkt_detail line=4373 msg="vd-root received a packet(proto=1, 172.27.219.254:34075->103.229.202.78:8) from vlan_staf_aruba. code=8, type=0, id=34075, seq=16." 2015-02-20 19:15:29 id=20085 trace_id=453 func=init_ip_session_common line=4522 msg="allocate a new session-0214e4ad" 2015-02-20 19:15:29 id=20085 trace_id=453 func=fw_local_in_handler line=382 msg="iprope_in_check() check failed on policy 0, drop"

 

Need your help ASAP.. thank you.

 

Daniel

Check if you have any ip-pool configured for ip 103.229.202.78.

Check if ip-pool range contains this ip and if so remove it.

ashukla wrote:

reverse patch check failed.

 

Firewall will check the route for the source ip address (172.27.216.3) through interface vlan_prkt_aruba and if there is no route then it will be dropped. 

Check and make sure you have a route to 172.27.216 network is there through interface vlan_prkt_aruba

Hi,

subnet 172.27.216.0/22 is in vlan called "vlan_prkt_aruba" create on fortigate's port34 (10GbE) , with ip address 172.27.216.1. And I have routing for this subnet, type connected.

The policy for this traffic is route, then I change to NAT. After changes, the traffic can flow normally.

Is there any other problem in this case?

Regards,

Daniel