second IP on internal interface - problem

Not sure if when you add a secondary IP, that the MAC address of the internal NIC would be the same for the first, but perhaps thats the issue? have a look by using the arp commands, like so; Show arp table # arp -a delete arp entry # arp -d 10.0.0.23 ping both IP' s and then look at the arp mac addresses for each. Why on earth you would want this kind of a setup is confusing though. I am presuming the client pc is on the same lan segment as the firewall interface.

whoops forgot to add, when you say you can ping to other machines on the 192.168.0.x network? are you saying that other pc' s have these secondary IP addresses and you can ping between themselves, but not to the fortigate?

that`s correct UkWizard. I have a few test servers which are connected to the same phisical network but they have other IP subnet: 192.168.0.x. (only one IP address per network card) I can ping between themselves and I can ping from my PC client, who has two IP addresses (one 10.0.0.x, second 192.168.0.x) to those servers. I can`t ping from my client to fortigate and I can`t ping from test servers to fortigate.

I don`t want to see one network from another (except my client PC - one computer). All I want is internet access from the second subnet (192.168.0.x). In the second subnet I have only test PC`s and I want to Fortigate act as internet gate only.

abelio, yes I did. But I even can not ping to Fortigate.

if you take out the 192.168. address out from your client, can you then ping the fortinet IP within the same subnet (ie 10.xxx) Also, what do you have as your default gateways on your machine and the test network machines? if they are all correct, then you should be able to ping that interface. but if routing doesnt work between the two, you will need a INTERNAL -> INTERNAL rule as well to allow the ' bouncing' traffic. You should also need to have two address entries in the fortinet with their interfaces selected, ie not left as any. But for the record, this is really really bad practice to have two subnets existing on the same segment. Do you not have a spare interface you could put the second network onto? thats the preferred method. Else i would recommend you invest in a switch that supports vlans, then do it that way, by vlanning them right up to the fortigate. you can do some sinple diags using the sniffer, so on the cli of the fortigate, run the following and then try a ping to the interface, and see if it hits it. if it doesnt, your switch must be screwing things up, potentially because of the dual subnet existence. # diag sniff packet any ' icmp'

I am confused. Situation looks as follows: All test PC` have 192.168.0.1 as default gateway and have only one IP address set manually. FortiGate unit have two IP addresses: 10.0.0.1 (primary with PING enabled) and 192.168.0.1 (secondary with PING enabled). If I have only one address on my network card (192.168.0.100) and default gateway i set to 192.168.0.1, I can ping to other test PC`s but i can not ping to FortiGate. FortiGate`s sniffer shows only:

icmp: echo request

When I change IP address to 10.0.0.100 (still is only one IP) and default gateway is set to 10.0.0.1, I can not ping to other test PC`s and I can ping to FortiGate on 10.0.0.1 and I can ping to FortiGate on 192.168.0.1 too!! FortiGate`s sniffer shows :

icmp: echo request  icmp: echo reply

do you have any policy routes defined? what static routes do you have? do you have any other interfaces configured, and if so, whats their IP?

Works okay on a test box here, and its running unpatched mr6 (660 build). What version are you running?

i bet its the policy route breaking this, whether its by design or a bug. Just as a quick test to eliminate it, take the policy route out temporarily and retest. You will need the INT to INT policy as well to allow the routing. if it works without that policy route, try changing the source subnet for it as the main internal IP subnet, rather than 0.0.0.0 and then retest.