| Description | This article describes how to handle an issue where there is no internet access due to a custom schedule in the policy. |
| Scope | FortiGate. |
| Solution |
In some scenarios, the user will not have access to the internet post-upgrade or power down due to a change in schedule or the user forgetting about the schedule created for the policy.
With custom schedules, the traffic will not match the policy depending upon the schedule set and will give the below output.
The troubleshooting will be done with a basic approach for internet access.
execute ping 1.1.1.1
The ping will work, the packets will be received and sent, and the debug will show 'Denied by forward policy check (policy 0)'.
diagnose sniffer packet any "host 1.1.1.1 and icmp" 4
# id=65308 trace_id=63 func=print_pkt_detail line=5870 msg="vd-root:0 received a packet(proto=1, 192.168.100.2:1->1.1.1.1:2048) tun_id=0.0.0.0 from por
It is necessary to verify the policy for the internet, which can be tested by creating a new policy by allowing all services and schedules. The internet will not always work with the below schedule.
The 'always' default schedule to allow traffic 24x7 is also editable, and it has been observed by TAC Engineers multiple times that some administrators change the default configuration of this default schedule, resulting in traffic getting blocked. The administrator should make sure it is using the default settings if traffic is getting blocked using the 'always' default schedule.
Related article: Technical Tip: Configuring a Schedule Firewall policy expiration |
