CLI pings cable modem GW but can't ping or traceroute beyond

[JJLatFortinet]

I'm setting up a new Fortigate 70D and have a basic problem connecting to the internet.  It seems like a pretty simple setup and I would appreciate some help.  It's running in Standalone/NAT mode.  wan1 is connected directly to a Cisco wifi-router/cable modem from Cox.  I've assigned FG70D wan1 a static IP of 192.168.0.9/24 with DGW 192.168.0.1.  The internal network ip range is 192.168.1.0/24.  The FG static route is set to 192.168.0.1.

config router static edit 1 set gateway 192.168.0.1 set device "wan1" next end

From the CLI, I can ping 192.168.0.1, but I can't ping or traceroute 8.8.8.8.  "100% packet loss" and 3 stars on every hop of the endless traceroute.  If I connect a laptop to the same port on the cable modem, the laptop can ping, traceroute, and roam the net.  The FG70D CLI can't do anything.  I've tried setting the macaddr to the same as the laptop, thinking that perhaps the cable modem had some mac restriction, but still no joy.  I have a policy (for testing) for "internal -> wan1" to allow all sources, all destinations, all services.  I'm not sure such a policy matters for the CLI, but internal to wan1 traffic doesn't work either.

I've rebooted the cable modem multiple times too.  I assume there's something simple that I'm missing.  What should I look for?

[ede_pfau]

Correct, traffic originating from the FGT itself is not controlled by (regular) policies but it uses the same session table, DNS, routes etc.

Enabling NAT will only have any effect if the WAN address of the FGT is a public IP, handed down 1:1 from the modem.

All the time I wonder what happened when you configured the FGT's WAN port for DHCP...it should act like the PC then, right? Were you then able to access internet?

[rwpatterson]

disregard

[JJLatFortinet]

toshiesumi wrote:

Since it's going out through wan1 with the source IP you set, the problem is on the cable modem/router not on the FG. You mentioned the FG didn't get DHCP IP somehow. That sounds fishy to me.

I agree.  I suspect the cable modem.  It still baffles me a bit that computers can pick up IPs by DHCP and traceroute without a hitch, but FG won't.  I may ask Cox to replace the modem, it's just hard to get them to configure it correctly with less than 3 phone calls.  If connected computers had the same inability to pick up an IP or to traceroute out, I would replace the modem as the first step.  But when the FG is the only device that can't traceroute out, it's harder to justify in my head.  We'll see what happens when the new FG is config'd for production and connected to the bridged port on the cable modem.