Please help. Strangest thing ever...

ShahafCZ · ‎11-22-2021

Hi all,

I have a LAN connected to the internet using a FortiGate 60D.

Clients gets an IP Address from DHCP on the the scope of 192.168.1.101-130.

When a client gets an odd ip (ex. 192.168.1.101, 192.168.1.103, 192.168.1.105, etc. ....) they can connect to the internet without any problem.

When a client gets an even ip (ex. 192.168.1.102, 192.168.1.104, 192.168.1.106, etc. ...) they can NOT connect to the internet. their DHCP lease looks fine. they get a default gateway and all other configuration and they can access the LAN but for some reason the FortiGate blocks them from going on the Internet. They can ping the default gateway but not any hop behind it.

As a temporary solution I excluded all even numbers from the scope.

Any ideas of what can cause this behavior?

GDiFi · ‎11-22-2021

It sounds like you have load balancing turned on. The traffic is being load balanced between a good interface and one that you do not intend for it to use. This issue was seen by another community member and they found they had their secondary WAN interface setup but was not usable.

https://community.fortinet.com/t5/Fortinet-Forum/No-internet-access-for-odd-IP-addresses/m-p/79209?m...

View solution in original post

pciurea · ‎11-22-2021

It seems you have a ECMP condition (https://en.wikipedia.org/wiki/Equal-cost_multi-path_routing) and the FG will try to load balance the traffic between the two connections (ppp1 and ppp2). A load balancing algorithm is used to decide where the traffic goes through - check the default one (https://docs.fortinet.com/document/fortigate/6.2.9/cookbook/25967/equal-cost-multi-path) .The default static route is automatically added after the ppp connection is up. Is seems that maybe one of your ppp conection has issues.

To avoid load-balancing, you can alter the distance/priority of the default route that is injected in the routing table either in the GUI or the cli under the interface configuration.

"Serenity now. Insanity later"

View solution in original post

ConnyGustavsson · ‎11-24-2021

Hi. Faulty subnet mask on the firewall?
/Conny

cogus

ShahafCZ · ‎11-24-2021

No. It was load balancing with ECMP condition.