Skip to main content
digimetrica
New Member
July 10, 2017
Question

Weird route behaviour in 5.6

  • July 10, 2017
  • 11 replies
  • 22484 views

Hello, We manage several fortigates and this is the first i am clueless about this issue. I am UNABLE to reach the whole DMZ from the Internal LAN. Wan -> DMZ Works DMZ -> Internal Works (it was a test) LAN -> DMZ doesn't work. Policy was a plain one: Internal -> DMZ all open. We have tried a single pc connected to the internal just to exclude other network devices in the lan. Looking at the Flow debug it seems traffic goes toward default gateway to internet. Even a traceroute, the first step are * * * * I even tried to add static routes to client and it doesn't work, firewall dmz ip is reachable!!! I don't know what else to look at since this is something I do for years and it's easy to implement.

    11 replies

    net1
    New Member
    July 10, 2017

    Hi,

    are you trying to reach the DMZ via external (mapped ip) through NAT or directly (private to private IP) ...

    The only thing (AFAIK) which changed is the need of hairpinning when trying to reach internal networks form internal (via NAT) - this changend from 5.2 to 5.4 ...

     

     

    digimetrica
    New Member
    July 10, 2017

    Hello,

    private to private (192.168.1.x reaching a 192.168.2.10)

     

    reaching the server using a mapped ip from the Wan works.

    net1
    New Member
    July 10, 2017

    Hi,

     

    intresting ... did you try to ping via Fortigate CLI?

     

    First set the source IP with: 'execute ping-options source 192.168.1.x' (so it will ping from the internal LAN)

    Then a simple ping: 'execute ping 192.168.2.10'

     

    Does this work?

    Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
    Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
    Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT