Can' t route past default gateway

[Kenundrum]

I had a strange issue this weekend with one of my FGT-60Bs. it is connected to a cable modem through the WAN1 port and has a 3G wireless card failover. It failed over to the wireless card- so we thought the cable provider was down. After various troubleshooting steps, we were able to figure this out... From inside we can ping our default gateway. From outside, we could ping the default gateway. Could not ping anything past the gateway from inside or to us from outside. The internet was working fine through the 3G card. (outside tests involved remote controlling a computer at a remote site not connected through a VPN) The cable provider did a few things on their end, but still nothing. Eventually we plugged a computer directly to the modem and it worked perfectly. Switched the connection from the WAN1 to WAN2 and all of a sudden it works fine... (obviously after configuring the default gateway and firewall policies to use WAN2) Is this indicative of a bad port somehow? i' m finding it hard to believe that we could ping out but not get routing. i' d expect that a dead interface would just not work no matter what. but also that if we had something wrong in the configuration that it would also be wrong when we set up the WAN2... any ideas? Thanks

[darrell]

Perhaps your MAC address for your WAN1 port got de-registered and would not re-register with the cable provider? Changing to WAN2 would change your MAC address presented to the cable co, obviously. Our cable co normally tells you to power off your cable modem for 30 minutes to clear things out of their system (great fix, huh?), but it does actually seem to work some of the time.

[Kenundrum]

The tech at the Cable Co was able to clear the ARP and reset the MAC history etc etc out of our modem and their routers... he was able to detect that it was a fortinet once it was up on WAN2... i might try switching back to the original tonight and see what happens. it is such a pain to try to re-enter all of our firewall rules using WAN2 instead of WAN1 as the primary internet interface...

[g3rman]

You can copy and paste the rules on the command line, much faster. " show firewall policy"

[laf]

You can copy and paste the rules on the command line, much faster. " show firewall policy"

This has nothing to do with FW policies. He should be able to ping from the equipment' s console. So just check how s your ping in the GW: steady? Check the TTL value and after this issue a traceroute to 4.2.2.2. Post the results. Also tell us what do you see at Router- Monitor !

[darrell]

Can you just changed the src and dst iface via command line easily? It' s not like you have to rewrite the whole rule that way.