Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Carletto
New Contributor II

Basic question

Hi,

I just use these firewall from some days but I'm runnig into a problem.

I try to summurize

- Server A (192.168.0.230) is connected to Server OUT (192.168.100.200) through a 80E vers 6.2.6 

- Server A is able to ping (even reach http/https and so on) SERVER OUT

 

- I add server B 192.168.0.231 to the lan, I add to the rule on the firewall Server B ... but I'm not able to "ping" server OUT.

There are no routes on the servers

there are no rotes on the firewall (or even I'm not able to see them)

no software firewll on the server

If I "swap" ip addresses from SERVER A to SERVER B  B will be able to reach SERVER OUT and A no

If I change server B address to somethig differnet still no working (so there shuold not be dirty entries)

 

Can some one give me an idea to what to check?

Thank you in advance, hope to be understendable.

Carlo

Carlo Del Pietro
Carlo Del Pietro
1 Solution
Carletto
New Contributor II

Solved!

I made a backup of the configuration and reading the file i found an error in addressing the server (I worte 192 168 instead 192.168).

Thank you for your help, sorry for wasting time!

Carletto

Carlo Del Pietro

View solution in original post

Carlo Del Pietro
3 REPLIES 3
naibaho
New Contributor III

Hi Carletto,

 

You can try ping 192.168.100.200 from server B and run the following debug command to see what going on to the packet behind the scenes.

diag debug flow filter saddr <sourceip>

diag debug flow filter proto 1

diag debug flow trace start 5 (or a bigger number)

diag debug enable (to activate the debug)

 

best regard
best regard
Carletto
New Contributor II

Hi Naibaho,

thank you for your answer.

I'm not so confident with "command line" so I check in the logs session and I found that the connection is denied by policy 0 (the deny all).

the strange thing is that my server is included in policy 20 (which is above policy 0).

 

If i can say a stupid thing SEEMS that I do not "commit" the modified rule

 

Carlo

Carlo Del Pietro
Carlo Del Pietro
Carletto
New Contributor II

Solved!

I made a backup of the configuration and reading the file i found an error in addressing the server (I worte 192 168 instead 192.168).

Thank you for your help, sorry for wasting time!

Carletto

Carlo Del Pietro
Carlo Del Pietro
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors