Can t ping from my host client to internet via fortinet Firewall

[SALMABST]

Hello, Can you help me please I have a correct static routes and policies that enable the traffic to access internet my firewall can access internet when I ping 8.8.8.8 but the host client that is in the same network as the lan of the firewall and has as a gateway the Ip of the Lan can t ping to the internet I get request time out, I have policies of outbound that enable all traffic from Lan to wan

FortiOS-VM64 # config firewall policy

FortiOS-VM64 (policy) # edit 3

FortiOS-VM64 (3) # show
config firewall policy
edit 3
set name "Lan to wan"
set uuid 161ce1d2-2fa9-51ee-1c02-94434bc9f1d1
set srcintf "port5"
set dstintf "port1"
set action accept
set srcaddr "LAN"
set dstaddr "all"
set schedule "always"
set service "ALL"
set log traffic all
set Nat enable
next
end

, and static route
FortiOS-VM64 (2) # show
config router static
edit 2
set gateway 192.168.10.1
set device "port1"
next
end
port1 is the wan and port2 in the Lan here are my interfaces 
FortiOS-VM64 (interface) # show
config system interface
edit "mgmt"
set vdom "root"
set allow access ping https ssh fgfm
set status down
set type physical
set dedicated-to management
set snmp-index 1
next
edit "port1"
set vdom "root"
set ip 192.168.10.100 255.255.255.0
set allowaccess ping https ssh http
set type physical
set alias "wan"
set lldp-reception enable
set role wan
set snmp-index 2
next

edit "port5"
set vdom "root"
set ip 2.2.2.2 255.255.255.0
set allowaccess ping https ssh http fgfm
set type physical
set alias "LAN"
set lldp-transmission enable
set role lan
set snmp-index 6 , thank you

[npariyar]

Let's suppose you want to ping 8.8.8.8 from the host and the host IP is 2.2.2.5.

Do a continuous ping to 8.8.8.8 from 2.2.2.5 then capture the following logs:

CLI 1:

diagnose sniffer packet any 'host 8.8.8.8 and host 2.2.2.5 and icmp' 4 0 a 

CLI 2:

diagnose debug flow filter saddr 2.2.2.5
diagnose debug flow filter daddr 8.8.8.8
diagnose debug flow filter proto 1
diagnose debug flow show function-name
diagnose debug console timestamp enable
diagnose debug flow trace start 1000
diagnose debug enable

After collecting the logs, disable logging by:

diagnose debug disable
diagnose debug flow filter clear
diagnose debug reset

Share us the logs

[SALMABST]

---

---

FortiOS-VM64 # diagnose sniffer packet any 'host 8.8.8.8 and host 2.2.2.10 and icmp' 4 0 a
Using Original Sniffing Mode
interfaces=[any]
filters=[host 8.8.8.8 and host 2.2.2.10 and icmp]
2023-08-07 13:55:24.492527 port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request
2023-08-07 13:55:29.333920 port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request
2023-08-07 13:55:34.335090 port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request
2023-08-07 13:55:39.318743 port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request
^C
4 packets received by filter
0 packets dropped by kernel

FortiOS-VM64 # diagnose debug flow filter saddr 2.2.2.10

FortiOS-VM64 # diagnose debug flow filter daddr 8.8.8.8

FortiOS-VM64 # diagnose debug flow filter proto 1

FortiOS-VM64 # diagnose debug flow show function-name
show function name

FortiOS-VM64 # diagnose debug console timestamp enable

FortiOS-VM64 # diagnose debug flow trace start 1000

FortiOS-VM64 # diagnose debug enable

FortiOS-VM64 # 2023-08-07 06:59:10 id=65308 trace_id=1 func=print_pkt_detail line=5842 msg="vd-root:0 received a p
acket(proto=1, 2.2.2.10:1->8.8.8.8:2048) tun_id=0.0.0.0 from port5. type=8, code=0, id=1, seq=76."
2023-08-07 06:59:10 id=65308 trace_id=1 func=init_ip_session_common line=6028 msg="allocate a new session-0000032a
, tun_id=0.0.0.0"
2023-08-07 06:59:10 id=65308 trace_id=1 func=__vf_ip_route_input_rcu line=2012 msg="find a route: flag=00000000 gw
-192.168.10.1 via port1"
2023-08-07 06:59:14 id=65308 trace_id=2 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=1,
2.2.2.10:1->8.8.8.8:2048) tun_id=0.0.0.0 from port5. type=8, code=0, id=1, seq=77."
2023-08-07 06:59:14 id=65308 trace_id=2 func=init_ip_session_common line=6028 msg="allocate a new session-0000032f
, tun_id=0.0.0.0"
2023-08-07 06:59:14 id=65308 trace_id=2 func=__vf_ip_route_input_rcu line=2012 msg="find a route: flag=00000000 gw
-192.168.10.1 via port1"
2023-08-07 06:59:19 id=65308 trace_id=

---

@npariyar wrote:

Let's suppose you want to ping 8.8.8.8 from the host and the host IP is 2.2.2.5.

Do a continuous ping to 8.8.8.8 from 2.2.2.5 then capture the following logs:

CLI 1:

diagnose sniffer packet any 'host 8.8.8.8 and host 2.2.2.5 and icmp' 4 0 a 

CLI 2:

diagnose debug flow filter saddr 2.2.2.5
diagnose debug flow filter daddr 8.8.8.8
diagnose debug flow filter proto 1
diagnose debug flow show function-name
diagnose debug console timestamp enable
diagnose debug flow trace start 1000
diagnose debug enable

After collecting the logs, disable logging by:

diagnose debug disable
diagnose debug flow filter clear
diagnose debug reset

Share us the logs

---

3 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=1,
2.2.2.10:1->8.8.8.8:2048) tun_id=0.0.0.0 from port5. type=8, code=0, id=1, seq=78."
2023-08-07 06:59:19 id=65308 trace_id=3 func=init_ip_session_common line=6028 msg="allocate a new session-00000334
, tun_id=0.0.0.0"

[seshuganesh]

Hi Team,

As per the debug seems like we are not offloading session out of the firewall. This could happen if there is any ISP issue:

Could you please ping to ISP gateway from the firewall, see if we are pinging or not.

If we are not able to ping, please execute this command:

diag sniffer packet any 'host <ISP-GW>' 4 0 a

After executing the above command, please ping to ISP gateway in another console and share us the result

[SALMABST]

yes I can oing to the ISP gateway this time is 172.20.10.1
FortiOS-VM64 # exec ping 172.20.10.1
PING 172.20.10.1 (172.20.10.1): 56 data bytes
64 bytes from 172.20.10.1: icmp_seq=0 ttl=64 time=12.7 ms
64 bytes from 172.20.10.1: icmp_seq=1 ttl=64 time=9.3 ms
^C
--- 172.20.10.1 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 9.3/11.0/12.7 ms

[msanjaypadma]

Hi @SALMABST ,

You can share those requested logs. 

SSH 1:
get router info routing detail <destination>
get router info routing detail <source>

diag debug reset
diag debug disable
diag debug flow filter clear
diag debug flow filter addr x.x.x.x <--- IP address of the destination
diag debug flow show iprope enable
diag debug flow show function-name enable
diag debug console timestamp enable
diag debug flow trace start 9999
diag debug enable


SSH 2:
diag sniffer packet any “host y.y.y.y “ 6 0 l <<<<<<<where y.y.y.y is destination ip address

And now try to initiate ping request from PC.

Once logs generated now stop all traffic on user PC.

[FortiNitish]

You need to check if the traffic is hitting the firewall interface first.

You can check that by running a packet capture using the source IP of the host

diag sniffer packet any 'host x.x.x.x' 4 0 a ( x.x.x.x is the source IP of the host machine in your LAN network)

I could see that 2.2.2.5 is the IP you have mentioned as the source IP, I would request you to check the IP once again as it is public IP. Please ensure the host machine is in the lan network.

[FortiNitish]

You need to check if the traffic is hitting the firewall interface first.

You can check that by running a packet capture using the source IP of the host

diag sniffer packet any 'host x.x.x.x' 4 0 a ( x.x.x.x is the source IP of the host machine in your LAN network)

I could see that 2.2.2.2 is the IP you have mentioned as the source interface IP, I would request you to check the IP once again as it is public IP. Please ensure the host machine is in the Lan network.

[SALMABST]

FortiOS-VM64 # diagnose sniffer packet any 'host 8.8.8.8 and host 2.2.2.10 and icmp' 4 0 a
Using Original Sniffing Mode
interfaces=[any]
filters=[host 8.8.8.8 and host 2.2.2.10 and icmp]
2023-08-07 13:55:24.492527 port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request
2023-08-07 13:55:29.333920 port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request
2023-08-07 13:55:34.335090 port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request
2023-08-07 13:55:39.318743 port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request
^C
4 packets received by filter
0 packets dropped by kernel

FortiOS-VM64 # diagnose debug flow filter saddr 2.2.2.10

FortiOS-VM64 # diagnose debug flow filter daddr 8.8.8.8

FortiOS-VM64 # diagnose debug flow filter proto 1

FortiOS-VM64 # diagnose debug flow show function-name
show function name

FortiOS-VM64 # diagnose debug console timestamp enable

FortiOS-VM64 # diagnose debug flow trace start 1000

FortiOS-VM64 # diagnose debug enable

FortiOS-VM64 # 2023-08-07 06:59:10 id=65308 trace_id=1 func=print_pkt_detail line=5842 msg="vd-root:0 received a p
acket(proto=1, 2.2.2.10:1->8.8.8.8:2048) tun_id=0.0.0.0 from port5. type=8, code=0, id=1, seq=76."
2023-08-07 06:59:10 id=65308 trace_id=1 func=init_ip_session_common line=6028 msg="allocate a new session-0000032a
, tun_id=0.0.0.0"
2023-08-07 06:59:10 id=65308 trace_id=1 func=__vf_ip_route_input_rcu line=2012 msg="find a route: flag=00000000 gw
-192.168.10.1 via port1"
2023-08-07 06:59:14 id=65308 trace_id=2 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=1,
2.2.2.10:1->8.8.8.8:2048) tun_id=0.0.0.0 from port5. type=8, code=0, id=1, seq=77."
2023-08-07 06:59:14 id=65308 trace_id=2 func=init_ip_session_common line=6028 msg="allocate a new session-0000032f
, tun_id=0.0.0.0"
2023-08-07 06:59:14 id=65308 trace_id=2 func=__vf_ip_route_input_rcu line=2012 msg="find a route: flag=00000000 gw
-192.168.10.1 via port1"
2023-08-07 06:59:19 id=65308 trace_id=3 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=1,
2.2.2.10:1->8.8.8.8:2048) tun_id=0.0.0.0 from port5. type=8, code=0, id=1, seq=78."
2023-08-07 06:59:19 id=65308 trace_id=3 func=init_ip_session_common line=6028 msg="allocate a new session-00000334
, tun_id=0.0.0.0"

[msanjaypadma]

Hi @SALMABST ,

From above shared logs, we can understand only ICMP echo request packet is coming in  

"port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request"

Since NAT is enabled, we will not able to confirm from above packet capture , is that packet going out or not. 
And in debug logs as well, not able to see policy lookup. 

Try to run below packet capture and debug  and could you please share the logs again. 

SSH 1:
get router info routing detail <destination>
get router info routing detail <source>

diag debug reset
diag debug disable
diag debug flow filter clear
diag debug flow filter addr x.x.x.x <--- IP address of the destination
diag debug flow show iprope enable
diag debug flow show function-name enable
diag debug console timestamp enable
diag debug flow trace start 9999
diag debug enable


SSH 2:
diag sniffer packet any “host y.y.y.y “ 6 0 l <<<<<<<where y.y.y.y is destination ip address

And now try to initiate ping request from PC.

Once logs generated now stop all traffic on user PC.

Thanks,