Trying to understand the packet flow when using Fortigate Firewall

Hello  @watl ,

Thank you for contacting the Fortinet Forum portal.

From my understanding of topology :

User --- edge switch --- FortiGate --- core switch L3 ---- ISP WAN router -- Internet

-Correct me if I am wrong with the flow. If the user PC pings google the request goes to FortiGate based on routing configuration, and you have it forwards further accordingly.

-The best way is to try ping and run sniffer on Fortigate so that you can understand which interface packet leaves and if the ping reply is coming back or not based on that you could proceed further to inspect packet flow :

Diagnose sniffer packet any "host x.x.x.x and icmp" 4 0 l

-here x.x.x.x is user PC

Best regards,

Manasa.

If you feel the above steps helped resolve the issue, mark the reply as solved so that other customers can get it easily while searching for similar scenarios.

Hi @watl,

The best tools to check packet flow in Fortigate are Sniffer and flow filter.

Sniffer ----> to check in and out interface

flow filter----> to check in detail including gateway and policy being used

to learn how to use these articles: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-First-steps-to-troubleshoot-connectivity/ta-p/192560?externalId=FD30038

By default, reverse traffic should take the same route used while going out.

Regards

Rajan

IMHO the routing is crooked.

If, and only if, the core switch is routing, it's default route should point to the WAN router. Any local traffic (from LAN) should be coming from the FGT, with the FGT's WAN address as the NATted source address - this is the standard setup, WAN bound traffic is NATted.

I have my doubts that the core switch should be routing at all. Maybe that was it's role until the FGT was integrated but now the FGT can take over the routing role. The FGT's default route would then be the WAN router, bypassing the core switch.

It really depends on whether there is traffic coming in from the LAN via the core switch. Shouldn't be but might be the case.

Thank you for all the guidance thus far.

I setup a sniffer trace for my PC and when I ping google.com I can see the packet comes in on a virtual interface vDefault then goes out the Aggregated Link and then to the physical link X2.

The physical links (x1 and x2) are connected to the core switch.

Which I assume means the core switch is doing the routing out to the internet

9.710732 vDefault in 10.192.129.28 -> 142.250.204.14: icmp: echo request
9.712439 vDefault out 142.250.204.14 -> 10.192.129.28: icmp: echo reply
9.712441 AggLink out 142.250.204.14 -> 10.192.129.28: icmp: echo reply
9.712443 x1 out 142.250.204.14 -> 10.192.129.28: icmp: echo reply

If my host is connected to an Edge Switch which is connected to the core switch how does the packet come in on the Virtual Interface vDefault?

could you please attach a diagram of your topology? looking at your sniffer it seems like this is your traffic flow. user -> edge switch -> fortigate -> core switch -> wan switch --> internet. In this network, the fortigate, core switch and wan switch are Layer 3 devices all capable of doing routing. Ultimately on a basic level, the ip of your core switch is fortigate's default gateway and the ip of your wan switch is your core switch's default gateway; your wan switch is the final hop in your network before the packet goes to the internet.