Troubleshooting Tip: Ping fails to the WAN IP of FortiGate

[SassiVeeran]

Description	This article describes how to ensure ping is reachable to a FortiGate WAN IP in the Dashboard with VIP configured.
Scope	FortiGate 6.4.8 and below.
Solution	A test ping failure to the FortiGate WAN IP shows in the dashboard from the internal network. A sniffer packet shows the packet enters FortiGate but no ping reply is received from the WAN IP. Debugging shows the packet was dropped with the error 'iprope_in_check() check failed on policy 0, drop'. In this example, the WAN IP is 161.142.148.52. Sniffer: Debug: No IPpool is configured. It was discovered that FortiGate has a VIP configured mapping the WAN IP to an internal IP address. However, it was not used in any firewall policy. This is due to how VIPs are considered local IP addresses if responding to ARP requests on these external IP addresses is enabled. The solution is to disable ARP replies in the VIP. config firewall vip     edit <name>         set arp-reply disable (default: enable)     next end Related document: Technical Tip: IP pool and virtual IP behavior changes in FortiOS 6.4, 7.0, 7.2, and 7.4.