Configure mgmt interface with vlan | can't ping in from remote location

[toms73]

Version: FortiGate-VM64-KVM v5.4.4,build7605,170208 (GA)

I'm trying to setup fortinet management going through port1 with vlan 333, I was able to ping out from fortinet to outside world but unable to ping into fortinet from remote location. the setup is the following 

PC -> Juniper NFX250 -> Fortinet 

Please let me know as to why the packets are not going out from port1?

Did I do setup correctly?

I have another product attached to Juniper NFX250 and I can ping in and out without any issues.

below is my setup:

FortiGate-VM64-KVM (interface) # show

config system interface
    edit "port1"
        set vdom "root"

        set allowaccess ping https ssh http fgfm

        set type physical

        set role wan

        set snmp-index 2

    next

    edit "port2"

        set vdom "root"

        set type physical

        set snmp-index 3

    next

    edit "port3"

        set vdom "root"

        set type physical

        set snmp-index 4

    next

    edit "ssl.root"

        set vdom "root"

        set type tunnel

        set alias "SSL VPN interface"

        set snmp-index 1

    next

    edit "vlan333"

        set vdom "root"

        set ip 10.92.24.106 255.255.255.0

        set allowaccess ping https ssh http fgfm

        set role lan

        set snmp-index 5

        set interface "port1"

        set vlanid 333

    next

end



FortiGate-VM64-KVM # get router info routing-table all

Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP

       O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

       * - candidate default

 

C 10.92.24.0/24 is directly connected, vlan333

 below is what I'm seeing when I try to ping from remote location to Fortinet, the packets are coming in but going no where...

FortiGate-VM64-KVM # diag sniffer packet port1 "icmp" 10.92.24.106 -I port1
interfaces=[port1]
filters=[icmp]
pcap_lookupnet: port1: no IPv4 address assigned

0 packets received by filter
0 packets dropped by kernel

FortiGate-VM64-KVM # diag sniffer packet vlan333 "icmp" 10.92.24.106 -I port1
interfaces=[vlan333]
filters=[icmp]
3.796072 10.88.233.1 -> 10.92.24.106: icmp: echo request
4.795824 10.88.233.1 -> 10.92.24.106: icmp: echo request

 I'm also seeing this:

FortiGate-VM64-KVM # id=20085 trace_id=21 func=print_pkt_detail line=4793 msg="vd-root received a packet(proto=17, 0.0.0.0:68->255.255.255.255:67) from vlan333. "

id=20085 trace_id=21 func=init_ip_session_common line=4944 msg="allocate a new session-00002e79"

id=20085 trace_id=21 func=vf_ip_route_input_common line=2586 msg="find a route: flag=90000000 gw-255.255.255.255 via root"

id=20085 trace_id=21 func=fw_local_in_handler line=390 msg="iprope_in_check() check failed on policy 0, drop"

id=20085 trace_id=22 func=print_pkt_detail line=4793 msg="vd-root received a packet(proto=2, 10.92.24.44:0->224.0.0.251:0) from vlan333. "

id=20085 trace_id=22 func=init_ip_session_common line=4944 msg="allocate a new session-00002e7a"

id=20085 trace_id=22 func=ip_session_handle_no_dst line=5018 msg="trace"

 

[lobstercreed]

Do you have trusted hosts set in your admin profiles?  All admin access methods are only allowed from trusted hosts.  You may have to open management up to the outside world if you want to ping from the outside world.

[toms73]

maybe it's broken with VLAN. I've tried but nothing with VLAN, works fine without VLAN. Do you mind giving examples or point a doc on this for CLI? The password is removed below....

FortiGate-VM64-KVM (admin) # show

config system admin

    edit "admin"

        set accprofile "super_admin"

        set vdom "root"

        set password ENC SH233pCKxJsRW96bJRMrjBtq3kUCo7ZRYnqqd/xxxxxxxxxxx

    next

    edit "doc-admin"

        set trusthost1 10.0.0.0 255.0.0.0

        set trusthost2 192.168.0.0 255.255.0.0

        set accprofile "super_admin"

        set vdom "root"

    next

end

[Toshi_Esumi]

Because you don't have a route back to 10.88.233.1.

[toms73]

 Nevermind, I got it

config router static
                edit 1
                set dst 0.0.0.0 0.0.0.0
                set gateway 10.92.24.1
                set device vlan333
                next
                end

[Toshi_Esumi]

Since you don't have any routes configured, I'm assuming you're just testing with this FGT at this moment.

If the vlan333 is dedicated for management and only 10.88.233.0/24 needs to reach the FGT, you can put like below in.

config router static

    edit 0

        set dst 10.88.233.0 255.255.255.0

        set gateway <Juniper's_GW_address_in_10.92.24.0/24>

        set device vlan333

    next

end

Although I never touched FGT-VM, FGT config part shouldn't change between chassis ones and VM ones. Then you can search internet like "fortigate CLI static routes" and would find a bunch of online manual pages like below:

https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-advanced-routing-54/Routing_Advanced...

You still need to add a default route to make anybody be able to use the FGT though.