Skip to main content
LarryD
LarryD
Visitor III
August 31, 2022
Question

Routing Problem

  • August 31, 2022
  • 3 replies
  • 4739 views
I have an old Fortigate 200D, that I am sooo close to getting setup. The firewall won't ping 8.8.8,8, and I know I'm doing something stupid with the routing. It even says can't find route to host when I Ping off of the LAN. I have screenshots, and it's a basic setup for 5 computers. I have 0.0.0.0/0.0.0.0 the default in the static routes for the WAN. And a 192.168.0.0/24 static route, with the gateway of the LAN 192.168.23.1. I have the LAN Interface setup on port1 and am able to connect with DHCP enabled and 192.168.23.1 as the gateway on that Interface. But when I go to Static Route Monitor, it says the LAN, and WAN, are connected but with Gateways of 0.0.0.0. How do I get the Gateway in there so the firewall, and the LAN will be able to ping 8.8.8.8? Any help will be super super appreciated! Having trouble finding posts about this little problem. I believe the firmware is at 5.something Thx!

3 replies

parteeksharma
Staff
parteeksharma
Staff
August 31, 2022


Hi LarryD,

Please be informed that If your FortiGate is sitting at the edge of the network, your next hop will be your ISP gateway. This provides internet access for your network.

Also the next-hop IP address i.e gateway should be reachable from the fortigate device and the arp should be learnt on fortigate. You can check the ARP table entry using command "get sys arp".

If the gateway is reachable then route will be active in the routing-table and the 8.8.8.8 should be accessible through fortigate.


Best Regards,
Parteek

    LarryD
    LarryDAuthor
    Visitor III
    August 31, 2022

    Thanks Parteek!    It's such a simple setup I must be missing something in the Routing assignments. I've linked screenshots. And even a trace I did earlier trying to see what I did wrong

     

    https://drive.google.com/file/d/1TsidD-WoaqTI7h16Z78zYhXAaJ6-HQ5f/view?usp=sharing

     

    https://drive.google.com/file/d/1t3Fs1B4X5uDFMOq4LIsTN0M2IMGVefA3/view?usp=sharing

     

    https://drive.google.com/file/d/1yaOHMTHWBep62DXlonDcLKARsfVkLO6C/view?usp=sharing

     

    https://drive.google.com/file/d/1fw4keShQfdNhTrGemFGdPWbJ5Ze2YUZt/view?usp=sharing

     

    https://drive.google.com/file/d/1VowhU1bFU1H6kDM7eHriuRuX8vQSMPIy/view?usp=sharing

     

    https://drive.google.com/file/d/1sfploRgL45YLA7CAiD-mQmOYLyVfnLhn/view?usp=sharing

    parteeksharma
    Staff
    parteeksharma
    Staff
    September 5, 2022


    Hi Larry,

    As per the screenshots, it seems you are able to ping 8.8.8.8 from Fortigate device using wan2 link. The ping is successful from Fortigate.


    Best Regards,
    Parteek

    rosatechnocrat
    rosatechnocrat
    Explorer III
    September 1, 2022

    Dear LarryD,

     

    Please share the output of "#get router info routing-table all" command from the CLI.  and a ping output for your gateways . 

    execute ping 192.168.23.1

    execute ping <WAN-GW-IP> 

     

     

     

    Subscribe "ROSA Technocrat" on Youtube for Fortinet Videos and Troubleshooting https://www.youtube.com/@rosatechnocrat
    sw2090
    SuperUser
    sw2090
    SuperUser
    September 5, 2022

    On your Screenshots one can see that the two connected routes for lan and wan2 do not have a gateway which is actually correct. The only one that needs to have a gateway in your case is the default route and that does have a gateway.

    The other screenshot shows log output that looks indeed like if you were able to ping.

    Thus - for clients in your lan - you also have to have a policy (with sNAT enabled) to allow traffic into the internet. 

    Also you have to make sure that the default route on your clients in your lan has the FGT as gateway.

    syordanov
    Staff
    syordanov
    Staff
    September 5, 2022

    Dear LarryD,
    please run the following debug :

     

    diagnose debug reset
    diagnose debug disable
    diagnose debug flow filter proto 1
    diagnose debug flow filter daddr 8.8.8.8
    diag debug flow show function-name enable
    diag debug flow show iprope enable
    diagnose debug console timestamp enable
    diagnose debug flow trace start 999
    diagnose debug enable

    Please generate ping from your local PC to 8.8.8.8, collect the debug and then stop the debug :


    diagnose debug disable

    Terms & ConditionsAccessibility statement