Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
sonydarrel
New Contributor

Communication to fortigate

Please find the attached diagram,

 

I have 2 issues mentioned below.

 

[ol]
  • Sometime while adding  a policies it gives me an error "entry not found"
  •  syslog server is not receiving syslog from fortinet and also unsable to ping the server ip add 192.168.13.10 though i have a route to internal LAN for syslog server.
  • I have a active passive HA configured and it shows me in dashboard but when i remove the link from the  master fortigate connecting to internet switch the internet stops completely for the lan users it is not failing to slave, i am thinkinig the Cisco technology that whenever a link fails it shld failover to the healthy firewall which is slave in our situation please correct me if i m wrong.[/ol]

     

    Thanks

  • 8 REPLIES 8
    sonydarrel
    New Contributor

     

    Dears,

     

    anybody can help me to solve the below issues

     

    Thanks

    mac
    New Contributor

    hi

     

    Refer to the troubleshooting procedures to debug.

     

    mac

    vjoshi_FTNT
    Staff
    Staff

    Hello,

     

    1) What is the browser and its version. Does it happen with all the GUI options or specific?

    2) You should be able ping the IP of the Syslog server at first place. If the Fortigate interface and the syslog server belong to two different interfaces, then make sure there is a Firewall policy allowing the traffic between the Fortigate and the syslog server

     

    3) Under the HA settings, make sure that WAN interface is selected for PORT MONITORING

     

    sonydarrel wrote:

    Please find the attached diagram,

     

    I have 2 issues mentioned below.

     

    [ol]
  • Sometime while adding  a policies it gives me an error "entry not found"
  •  syslog server is not receiving syslog from fortinet and also unsable to ping the server ip add 192.168.13.10 though i have a route to internal LAN for syslog server.
  • I have a active passive HA configured and it shows me in dashboard but when i remove the link from the  master fortigate connecting to internet switch the internet stops completely for the lan users it is not failing to slave, i am thinkinig the Cisco technology that whenever a link fails it shld failover to the healthy firewall which is slave in our situation please correct me if i m wrong.[/ol]

     

    Thanks

  • sonydarrel

    Dear Thanks for the reply,

     

    for my question 2:  Please correct me if i am understanding is wrong for policy definition " we need a policy when traffic is passing through a firewall means" entering on interface 1 and exiting interface 2, but in my case traffic is destined to fortinet it is not exiting from interface 2, It is entering on interface 1 and on the same interface the reply should back to the syslog server.

     

    Please help replies will be appreciated.

     

    Thanks

    emnoc
    Esteemed Contributor III

    Okay let's start 1-by-1

     

    1:  Are you adding a new policy or editing an existing ( what happens from the cli assuming your using  webgui )

     

    2: yes your correct, if nothing is blocking icmp, you should be able to ping the syslog-server, have you ran diag sniffer packet <interface name> " port 514 or icmp"  to see if syslog is being sent to the syslog-server or icmp when  you ping? For generation of syslog, fail login a few times  & that should rise a syslog event, but I bet you don't have syslog or logging actually "enabled status on"

     

    e.g assuing your outbound interface is named port1 and the syslog server is at  1.1.1.1

     

    diag sniffer packet port1 " dst host 1.1.1.1 and port 514 "

    diag sniffer packet port1 " dst host 1.1.1.1 and icmp "

     

    3: for this item#3, you assumption are correct. If the healthy firewall fails, and you have heartbeat monitor enabled on, than it will fail to the slave ( it's technically NOT called a secondary like in cisco ASA lingo )

     

    So can you share the HA cfg on both systems and what/how did you configure the 2 unit ( the same code, firmware, model-type, etc........)

     

     

     

    PCNSE 

    NSE 

    StrongSwan  

    PCNSE NSE StrongSwan
    sonydarrel

     

    [ol]
  • When I am editing the existing policy at that situation it displays the error, i didn't tried by cli but i will try and update soon, but i have a question for policies if suppose i specify " any " for incoming and outgoing interface and if i  control by source and destination address only then is it a less secure from the security perspective,, i do understand that we are restricting to specific source and destiantion interface for the address but still need to confirm that  will it be according to the best practice if we  use " any " in interface selection  ???? ,, becz in asa firewall we don't have to specify any incoming and outgoing interface except source and destination address and port number.
  • I will collect the logs and post it tomorrow
  • attached are the configs for the fortinet.[/ol]

     

  • vjoshi_FTNT

    1.

    a) Which firewall policy to be used is decided on the routing decision > Firewall policy check is done from top to bottom order > When you select interface, first thing that gets changed is view. View changes from Section to Global view > In my understanding, if there is a Firewall policy on top with source interface 'any' Firewall has to do another check for the source/destination also to confirm if the policy allows or not. And then move to the other which is an overhead

     

    b) Security will be a concern if the policies are not properly configured > Say, you there are servers on DMZ and you have allowed only from LAN > DMZ. - When you have a policy from ANY to DMZ, anyone can attempt a connection from WAN or any interface if they are routable > Also, spoofing is possible if the default settings for anti-replay is changed > If the source and destination addresses can be restricted as required, security wise, it should be all the same. So, you must be very careful and consider the above before using interface ANY. 2) .. 3) Could you please confirm if the WAN interface is port17 or port 18 ?

     

    sonydarrel wrote:

     

    [ol]
  • When I am editing the existing policy at that situation it displays the error, i didn't tried by cli but i will try and update soon, but i have a question for policies if suppose i specify " any " for incoming and outgoing interface and if i  control by source and destination address only then is it a less secure from the security perspective,, i do understand that we are restricting to specific source and destiantion interface for the address but still need to confirm that  will it be according to the best practice if we  use " any " in interface selection  ???? ,, becz in asa firewall we don't have to specify any incoming and outgoing interface except source and destination address and port number.
  • I will collect the logs and post it tomorrow
  • attached are the configs for the fortinet.[/ol]

     

  • sonydarrel

    Dears,

    Anybody can confirm to me by policy i am doing something wrong.

    I have a  policy with multiple interfaces and multiple subnets from each interface as a source and destination is Internet with NAT enabled, all subnets are able to go on the internet except interface D subnet 10.10.13.0/24. Anybody can explain me where i doing things wrong.

     

    Thanks

     

    for Example:

    Source Interfaces

    interface-A

    interface-B

    Interface-C

    Interface-D

     

    Destination Interface

    Port 12 ------Connecting to internet

     

    Source Address

    10.10.10.0/24

    10.10.11.0/24

    10.10.12.0/24

    10.10.13.0/24

     

    Destination Address

    ANY

     

    Services

    HTTP

    HTTPS

    DNS

    FTP

     

    Announcements

    Select Forum Responses to become Knowledge Articles!

    Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

    Labels
    Top Kudoed Authors