Allow internet access to specific IP address with Fortiwifi 30e

[ryno]

Good day

I have a fortiwifi 30e configured on my network. we just installed a new alarm system at our office and connected it to the switch with LAN cable. The alarm cant connect to the internet at all, but i can see it on the network. if i log into the web interface i can see the alarm and IP address, but cant get the alarm unit to connect to the internet at all. the techies from the alarm company told me to open TCP & UDP port 1883 & 8883 but still i cant seem to get internet connection on the device. 

Any help in this regard will be greatly appreciated.

Kind Regards

Ryno 

[ede_pfau]

hi,

and welcome to the forums.

First off, do other devices on the same LAN have internet access? specifically, devices using the same address space (like 192.168.x.y).

If yes, the problem is your alarm device. If no, a policy on the FGT is missing.

- settings on the device:

in order to get out of the LAN, the device needs to know where to send traffic which destination is outside. This is the gateway setting. It should be the address of your FGT's port which is connected to the LAN (i.e., 'port1' or 'internal').

If this is set, observe the byte count in the outbound policy (i.e. 'internal' to 'wan').

Usually, all services are allowed outbound, so fiddling around with special ports would not be necessary. Of course, YMMV.

- missing WAN policy

Make sure there is an outbound policy from i.e. 'internal' to 'wan', allowing all wanted services, and with NAT enabled (!). You can check it by issuing 'ping 9.9.9.9' on a PC in your LAN.

[ryno]

Hi,

Thank you very much for your response. Yes all the other devices in that address space have internet access. I also thought that it is the alarm device, so I tested it on a LTE router and then the device gets internet connection. as soon as I put the device back on the network, it cant see the internet. the error I get is "NO RESPONSE FROM TIME SERVER". Also I can "ping 9.9.9.9" on the LAN and it returns packets, no packets lost. 

[ede_pfau]

Which timeserver? Is there a junction between being able to adjust the internal clock and communicating with the alarm server on the net? More than before I'd look into the config of the device to get an idea of how this is connected.

And why would the device not be able to contact a timeserver if connected to the LAN? Which IP address is used, and can you/another host reach that address from 'internal'?

Have a look whether the device needs DNS to resolve that address, or if it is configured by IP.

One timeserver I often use is 192.53.103.104 (ptbtime1.ptb.de, PTB Germany), if you need one for testing.