Can t ping from my host client to internet via fortinet Firewall

[SALMABST]

Hello, Can you help me please I have a correct static routes and policies that enable the traffic to access internet my firewall can access internet when I ping 8.8.8.8 but the host client that is in the same network as the lan of the firewall and has as a gateway the Ip of the Lan can t ping to the internet I get request time out, I have policies of outbound that enable all traffic from Lan to wan

FortiOS-VM64 # config firewall policy

FortiOS-VM64 (policy) # edit 3

FortiOS-VM64 (3) # show
config firewall policy
edit 3
set name "Lan to wan"
set uuid 161ce1d2-2fa9-51ee-1c02-94434bc9f1d1
set srcintf "port5"
set dstintf "port1"
set action accept
set srcaddr "LAN"
set dstaddr "all"
set schedule "always"
set service "ALL"
set log traffic all
set Nat enable
next
end

, and static route
FortiOS-VM64 (2) # show
config router static
edit 2
set gateway 192.168.10.1
set device "port1"
next
end
port1 is the wan and port2 in the Lan here are my interfaces 
FortiOS-VM64 (interface) # show
config system interface
edit "mgmt"
set vdom "root"
set allow access ping https ssh fgfm
set status down
set type physical
set dedicated-to management
set snmp-index 1
next
edit "port1"
set vdom "root"
set ip 192.168.10.100 255.255.255.0
set allowaccess ping https ssh http
set type physical
set alias "wan"
set lldp-reception enable
set role wan
set snmp-index 2
next

edit "port5"
set vdom "root"
set ip 2.2.2.2 255.255.255.0
set allowaccess ping https ssh http fgfm
set type physical
set alias "LAN"
set lldp-transmission enable
set role lan
set snmp-index 6 , thank you

[SALMABST]

FortiOS-VM64 # get router info routing detail 8.8.8.8

Routing table for VRF=0
Routing entry for 0.0.0.0/0
Known via "static", distance 5, metric 0, best
* vrf 0 172.20.10.1, via port1

Routing entry for 0.0.0.0/0
Known via "static", distance 10, metric 0
directly connected, port1

FortiOS-VM64 # get router info routing detail 2.2.2.10

Routing table for VRF=0
Routing entry for 2.2.2.0/24
Known via "connected", distance 0, metric 0, best
* is directly connected, port5

FortiOS-VM64 # diag debug reset

FortiOS-VM64 # diag debug disable

FortiOS-VM64 # diag debug flow filter clear

FortiOS-VM64 # diag debug flow filter addr
Host addr: any

FortiOS-VM64 # diag debug flow filter addr 8.8.8.8

FortiOS-VM64 # diag debug flow show iprope enable
show trace messages about iprope

FortiOS-VM64 # diag debug flow show function-name enable
show function name

FortiOS-VM64 # diag debug console timestamp enable

FortiOS-VM64 # diag debug flow trace start 9999

FortiOS-VM64 # diag debug enable

FortiOS-VM64 # 2023-08-08 02:59:28 id=65308 trace_id=151 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 172.20.10.2:6664->8.8.8.8:853) tun_id=0.0.0.0 from local. flag [S], seq 3866561924, ack 0, win 29200"
2023-08-08 02:59:28 id=65308 trace_id=151 func=init_ip_session_common line=6028 msg="allocate a new session-0000029d, tun_id=0.0.0.0"
2023-08-08 02:59:28 id=65308 trace_id=151 func=iprope_dnat_check line=5303 msg="in-[], out-[port1]"
2023-08-08 02:59:28 id=65308 trace_id=151 func=iprope_dnat_tree_check line=824 msg="len=0"
2023-08-08 02:59:28 id=65308 trace_id=151 func=iprope_dnat_check line=5315 msg="result: skb_flags-00000000, vid-0, ret-no-match, act-accept, flag-00000000"
2023-08-08 02:59:28 id=65308 trace_id=151 func=__iprope_check line=2307 msg="gnum-100004, check-000000004722e5a4"
2023-08-08 02:59:28 id=65308 trace_id=151 func=__iprope_check_one_policy line=2059 msg="checked gnum-100004 policy-3, ret-no-match, act-drop"
2023-08-08 02:59:28 id=65308 trace_id=151 func=__iprope_check_one_policy line=2059 msg="checked gnum-100004 policy-0, ret-no-match, act-drop"
2023-08-08 02:59:28 id=65308 trace_id=151 func=__iprope_check line=2324 msg="gnum-100004 check result: ret-no-match, act-drop, flag-00000000, flag2-00000000"
2023-08-08 02:59:28 id=65308 trace_id=151 func=iprope_policy_group_check line=4730 msg="after check: ret-no-match, act-drop, flag-00000000, flag2-00000000"
2023-08-08 02:59:28 id=65308 trace_id=151 func=ip_session_confirm_final line=3087 msg="npu_state=0x0, hook=4"
2023-08-08 02:59:28 id=65308 trace_id=152 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 8.8.8.8:853->172.20.10.2:6664) tun_id=0.0.0.0 from port1. flag [S.], seq 1078350162, ack 3866561925, win 65535"
2023-08-08 02:59:28 id=65308 trace_id=152 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, reply direction"
2023-08-08 02:59:28 id=65308 trace_id=152 func=__vf_ip_route_input_rcu line=2012 msg="find a route: flag=80000000 gw-0.0.0.0 via root"
2023-08-08 02:59:28 id=65308 trace_id=153 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 172.20.10.2:6664->8.8.8.8:853) tun_id=0.0.0.0 from local. flag [.], seq 3866561925, ack 1078350163, win 2"
2023-08-08 02:59:28 id=65308 trace_id=153 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, original direction"
2023-08-08 02:59:28 id=65308 trace_id=154 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 172.20.10.2:6664->8.8.8.8:853) tun_id=0.0.0.0 from local. flag [.], seq 3866561925, ack 1078350163, win 2"
2023-08-08 02:59:28 id=65308 trace_id=154 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, original direction"
2023-08-08 02:59:28 id=65308 trace_id=155 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 8.8.8.8:853->172.20.10.2:6664) tun_id=0.0.0.0 from port1. flag [.], seq 1078350163, ack 3866562380, win 261"
2023-08-08 02:59:28 id=65308 trace_id=155 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, reply direction"
2023-08-08 02:59:28 id=65308 trace_id=156 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 8.8.8.8:853->172.20.10.2:6664) tun_id=0.0.0.0 from port1. flag [.], seq 1078350163, ack 3866562380, win 261"
2023-08-08 02:59:28 id=65308 trace_id=156 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, reply direction"
2023-08-08 02:59:28 id=65308 trace_id=157 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 172.20.10.2:6664->8.8.8.8:853) tun_id=0.0.0.0 from local. flag [.], seq 3866562380, ack 1078351551, win 2"
2023-08-08 02:59:28 id=65308 trace_id=157 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, original direction"
2023-08-08 02:59:28 id=65308 trace_id=158 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 8.8.8.8:853->172.20.10.2:6664) tun_id=0.0.0.0 from port1. flag [.], seq 1078351551, ack 3866562380, win 261"
2023-08-08 02:59:28 id=65308 trace_id=158 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, reply direction"
2023-08-08 02:59:28 id=65308 trace_id=159 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 172.20.10.2:6664->8.8.8.8:853) tun_id=0.0.0.0 from local. flag [.], seq 3866562380, ack 1078352939, win 3"
2023-08-08 02:59:28 id=65308 trace_id=159 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, original direction"
2023-08-08 02:59:28 id=65308 trace_id=160 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 8.8.8.8:853->172.20.10.2:6664) tun_id=0.0.0.0 from port1. flag [.], seq 1078352939, ack 3866562380, win 261"
2023-08-08 02:59:28 id=65308 trace_id=160 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, reply direction"
2023-08-08 02:59:28 id=65308 trace_id=161 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 172.20.10.2:6664->8.8.8.8:853) tun_id=0.0.0.0 from local. flag [.], seq 3866562380, ack 1078354327, win 3"
2023-08-08 02:59:28 id=65308 trace_id=161 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, original direction"
2023-08-08 02:59:28 id=65308 trace_id=162 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 8.8.8.8:853->172.20.10.2:6664) tun_id=0.0.0.0 from port1. flag [.], seq 1078354327, ack 3866562380, win 261"
2023-08-08 02:59:28 id=65308 trace_id=162 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, reply direction"
2023-08-08 02:59:28 id=65308 trace_id=163 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 172.20.10.2:6664->8.8.8.8:853) tun_id=0.0.0.0 from local. flag [.], seq 3866562380, ack 1078354973, win 3"
2023-08-08 02:59:28 id=65308 trace_id=163 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, original direction"
2023-08-08 02:59:28 id=65308 trace_id=164 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 172.20.10.2:6664->8.8.8.8:853) tun_id=0.0.0.0 from local. flag [.], seq 3866562380, ack 1078354973, win 3"
2023-08-08 02:59:28 id=65308 trace_id=164 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, original direction"
2023-08-08 02:59:28 id=65308 trace_id=165 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 172.20.10.2:6664->8.8.8.8:853) tun_id=0.0.0.0 from local. flag [F.], seq 3866562404, ack 1078354973, win 3"
2023-08-08 02:59:29 id=65308 trace_id=165 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, original direction"
2023-08-08 02:59:29 id=65308 trace_id=166 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 8.8.8.8:853->172.20.10.2:6664) tun_id=0.0.0.0 from port1. flag [F.], seq 1078354973, ack 3866562405, win 261"
2023-08-08 02:59:29 id=65308 trace_id=166 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, reply direction"
2023-08-08 02:59:29 id=65308 trace_id=167 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 172.20.10.2:6664->8.8.8.8:853) tun_id=0.0.0.0 from local. flag [.], seq 3866562405, ack 1078354974, win 3"
2023-08-08 02:59:29 id=65308 trace_id=167 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, original direction"
2023-08-08 03:00:27 id=65308 trace_id=168 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=17, 2.2.2.10:53368->8.8.8.8:53) tun_id=0.0.0.0 from port5. "
2023-08-08 03:00:27 id=65308 trace_id=168 func=init_ip_session_common line=6028 msg="allocate a new session-000002a8, tun_id=0.0.0.0"
2023-08-08 03:00:27 id=65308 trace_id=168 func=iprope_dnat_check line=5303 msg="in-[port5], out-[]"
2023-08-08 03:00:27 id=65308 trace_id=168 func=iprope_dnat_tree_check line=824 msg="len=0"
2023-08-08 03:00:27 id=65308 trace_id=168 func=iprope_dnat_check line=5315 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
2023-08-08 03:00:27 id=65308 trace_id=168 func=__vf_ip_route_input_rcu line=2012 msg="find a route: flag=00000000 gw-172.20.10.1 via port1"
2023-08-08 03:00:28 id=65308 trace_id=169 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=17, 2.2.2.10:53368->8.8.8.8:53) tun_id=0.0.0.0 from port5. "
2023-08-08 03:00:28 id=65308 trace_id=169 func=init_ip_session_common line=6028 msg="allocate a new session-000002a9, tun_id=0.0.0.0"
2023-08-08 03:00:28 id=65308 trace_id=169 func=iprope_dnat_check line=5303 msg="in-[port5], out-[]"
2023-08-08 03:00:28 id=65308 trace_id=169 func=iprope_dnat_tree_check line=824 msg="len=0"
2023-08-08 03:00:28 id=65308 trace_id=169 func=iprope_dnat_check line=5315 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
2023-08-08 03:00:28 id=65308 trace_id=169 func=__vf_ip_route_input_rcu line=2012 msg="find a route: flag=00000000 gw-172.20.10.1 via port1"

FortiOS-VM64 # diag sniffer packet any "host 8.8.8.8" 6 0 l
Using Original Sniffing Mode
interfaces=[any]
filters=[host 8.8.8.8]
2023-08-08 02:53:56.930393 port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request
0x0000 0000 0000 0001 000c 297a e0bc 0800 4500 ........)z....E.
0x0010 003c 06a0 0000 8001 2006 0202 020a 0808 .<..............
0x0020 0808 0800 4d5a 0001 0001 6162 6364 6566 ....MZ....abcdef
0x0030 6768 696a 6b6c 6d6e 6f70 7172 7374 7576 ghijklmnopqrstuv
0x0040 7761 6263 6465 6667 6869 wabcdefghi

2023-08-08 02:54:01.527099 port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request
0x0000 0000 0000 0001 000c 297a e0bc 0800 4500 ........)z....E.
0x0010 003c 06a1 0000 8001 2005 0202 020a 0808 .<..............
0x0020 0808 0800 4d59 0001 0002 6162 6364 6566 ....MY....abcdef
0x0030 6768 696a 6b6c 6d6e 6f70 7172 7374 7576 ghijklmnopqrstuv
0x0040 7761 6263 6465 6667 6869 wabcdefghi

[msanjaypadma]

Hi @SALMABST ,

Could you please confirm , did you changed the Port1 IP configuration  ? 

As per the previous configuration , port1 subnet was belongs to 192.168.10.0/24, however current logs shows that you have default route pointing towards 172.20.10.1

Current Logs:

FortiOS-VM64 # get router info routing detail 8.8.8.8

Routing table for VRF=0
Routing entry for 0.0.0.0/0
Known via "static", distance 5, metric 0, best
* vrf 0 172.20.10.1, via port1

Old Logs:
edit "port1"
set vdom "root"
set ip 192.168.10.100 255.255.255.0 <<<<<<<<<<
set allowaccess ping https ssh http
set type physical
set alias "wan"
set lldp-reception enable
set role wan
set snmp-index 2
next

config router static
edit 2
set gateway 192.168.10.1 <<<<<<<<<
set device "port1"
next

Can you share below information  : 

show sys interface
show router static
show firewall policy
get router info routing  all

get router info routing-table database

[SALMABST]

Yes THE GATEWAY s now 172.20.10.1    because it s bridge depends on ISP

FortiOS-VM64 # show sys interface
config system interface
edit "mgmt"
set vdom "root"
set allowaccess ping https ssh fgfm
set status down
set type physical
set dedicated-to management
set snmp-index 1
next
edit "port1"
set vdom "root"
set mode dhcp
set allowaccess ping https ssh http
set type physical
set alias "wan"
set lldp-reception enable
set role wan
set snmp-index 2
next
edit "port2"
set vdom "root"
set allowaccess ping https ssh http telnet
set status down
set type physical
set device-identification enable
set snmp-index 3
next
edit "port3"
set vdom "root"
set type physical
set snmp-index 4
next
edit "port4"
set vdom "root"
set status down
set type physical
set snmp-index 5
next
edit "port5"
set vdom "root"
set ip 2.2.2.2 255.255.255.0
set allowaccess ping https ssh http fgfm
set type physical
set alias "LAN"
set lldp-transmission enable
set role lan
set snmp-index 6
next
edit "port6"
set vdom "root"
set type physical
set snmp-index 7
next
edit "port7"
set vdom "root"
set status down
set type physical
set snmp-index 8
next
edit "port8"
set vdom "root"
set status down
set type physical
set snmp-index 9
next
edit "port9"
set vdom "root"
set status down
set type physical
set snmp-index 10
next
edit "naf.root"
set vdom "root"
set type tunnel
set src-check disable
set snmp-index 11
next
edit "l2t.root"
set vdom "root"
set type tunnel
set snmp-index 12
next
edit "ssl.root"
set vdom "root"
set type tunnel
set alias "SSL VPN interface"
set snmp-index 13
next
edit "fortilink"
set vdom "root"
set fortilink enable
set ip 10.255.1.1 255.255.255.0
set allowaccess ping fabric
set type aggregate
set lldp-reception enable
set lldp-transmission enable
set snmp-index 14
next
end

FortiOS-VM64 # show router static
config router static
edit 1
set status disable
set device "mgmt"
next
edit 2
set device "port1"
next
end

FortiOS-VM64 # show firewall policy
config firewall policy
edit 3
set name "Lan to Wan"
set uuid 161ce1d2-2fa9-51ee-1c02-94434bc9f1d1
set srcintf "port5"
set dstintf "port1"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "PING"
set logtraffic all
set nat enable
next
end

FortiOS-VM64 # get router info routing all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
V - BGP VPNv4
* - candidate default

Routing table for VRF=0
S* 0.0.0.0/0 [5/0] via 172.20.10.1, port1, [1/0]
C 2.2.2.0/24 is directly connected, port5
C 172.20.10.0/28 is directly connected, port1

FortiOS-VM64 # get router info routing-table database
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
V - BGP VPNv4
> - selected route, * - FIB route, p - stale info

Routing table for VRF=0
S *> 0.0.0.0/0 [5/0] via 172.20.10.1, port1, [1/0]
S 0.0.0.0/0 [10/0] is directly connected, port1, [1/0]
C *> 2.2.2.0/24 is directly connected, port5
C *> 172.20.10.0/28 is directly connected, port1

[msanjaypadma]

Hi @SALMABST ,

Thank you for sharing the logs. 

Configuration seems to be fine. However in debug logs, I have observed traffic is initiated for 8.8.8.8 with dport 53 (dns) and dport 853 from local firewall.
I didn't observed traffic for PING from User PC in debug logs. 

Could you please collect the debug again for PING traffic. 

Please do this below step.

- Delete the static route which you have manually added 
config router static
delete 2 
end

-In Firewall policy set Services as "ALL" and try to collect debug logs after that. 
And If possible can you share configuration file? 
And share this command output => get sys status 

Thanks,

[SALMABST]

FortiOS-VM64 # get sys status
Version: FortiOS-VM64 v7.2.5,build1517,230606 (GA.F)
Security Level: 1
Virus-DB: 1.00000(2018-04-09 18:07)
Extended DB: 1.00000(2018-04-09 18:07)
Extreme DB: 1.00000(2018-04-09 18:07)
AV AI/ML Model: 0.00000(2001-01-01 00:00)
IPS-DB: 6.00741(2015-12-01 02:30)
IPS-ETDB: 6.00741(2015-12-01 02:30)
APP-DB: 6.00741(2015-12-01 02:30)
INDUSTRIAL-DB: 6.00741(2015-12-01 02:30)
IPS Malicious URL Database: 1.00001(2015-01-01 01:01)
IoT-Detect: 0.00000(2022-08-17 17:31)
Serial-Number: FOSVM1JM9XHNHNEA
License Status: Invalid
VM Resources: 1 CPU, 1997 MB RAM
Log hard disk: Available
Hostname: FortiOS-VM64
Private Encryption: Disable
Operation Mode: NAT
Current virtual domain: root
Max number of virtual domains: 2
Virtual domains status: 1 in NAT mode, 0 in TP mode
Virtual domain configuration: disable
FIPS-CC mode: disable
Current HA mode: standalone
Branch point: 1517
Release Version Information: GA
FortiOS x86-64: Yes
System time: Tue Aug 8 10:19:54 2023
Last reboot reason: power cycle

FortiOS-VM64 #

[SALMABST]

I can t share the config file cause it s much bigger than20 000 word

[pgautam]

Hi @SALMABST

As per the attached logs and description your traffic flow is below:-

Test PC (2.2.2.10)------(port5)(2.2.2.2)[FGT](port1)(192.168.10.100)----GW IP 192.168.10.1-----Internet(8.8.8.8)

As per the Flow debug packets are coming in on FGT from the correct interface:-

2023-08-07 13:55:24.492527 port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request
2023-08-07 13:55:29.333920 port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request

2023-08-07 06:59:10 id=65308 trace_id=1 func=print_pkt_detail line=5842 msg="vd-root:0 received a p
acket(proto=1, 2.2.2.10:1->8.8.8.8:2048) tun_id=0.0.0.0 from port5. type=8, code=0, id=1, seq=76."
2023-08-07 06:59:10 id=65308 trace_id=1 func=init_ip_session_common line=6028 msg="allocate a new session-0000032a
, tun_id=0.0.0.0"
2023-08-07 06:59:10 id=65308 trace_id=1 func=__vf_ip_route_input_rcu line=2012 msg="find a route: flag=00000000 gw
-192.168.10.1 via port1"

From the logs, we observe that traffic is not offloading from the firewall.

Please follow the below plan of action to check further:-
++ Ping 192.168.10.1 gateway from Firewall
++ If ping fails then confirm the layer 2 connectivity and check the arp entry

get sys arp

++ If layer 2 connectivity is fine and ping also working in that case collect the comamnds output shared by @msanjaypadma and open a TAC case.

Regards
Priyanka

- Have you found a solution? Then give your helper a "Kudos" and mark the solution.