DMZ - IP Address conflict!

[#1]

I can' t figure this out. I have Fortigate-60 (firmware 413 - build8424) and have DMZ interface configured with the address 192.168.10.1/255.255.255.0. I have a PC directly connected to the DMZ port with a static address 192.168.10.10/255.255.255.0. For some reason, the PC will not connect to the network. Windows complains that there is an IP address conflict with another system on the network. Checking the logs on the PC and it shows the conflict is with the DMZ interface. ( I can tell by the MAC address.) Am I missing something here????? Any suggestions at all are appreciated.

[rwpatterson]

That' s not so abnormal. If no traffic has hit that device in a while, the entry will drop from the arp table. Execute a ping from the command line, then execute the command once again. The entry should then be populated.

[UkWizard]

yes. thats correct, it doesnt show its internal interfaces.... try removing the vip, maybe thats the cause.

[UkWizard]

another thing to try is turning on dhcp and letting the pc get the dhcp address. (scope of 1 ip).

[#5]

Okay - making little progress here....Windows is not complaining about duplicate IP addresses anymore. The network has two addresses: FG-60 DMZ: 192.168.100.1/255.255.255.0 PC: 192.168.100.10/255.255.255.0 I tried with different addresses, with and without VIPs. There are no IP Pools From the FG-60, I can ping in all directions (wan1, internal, dmz) but can' t ping from the PC on the dmz across to wan1, for instance. Sniffer on the DMZ port gives me this: 493.207062 192.168.100.10 -> 192.168.100.1: icmp: echo request 627.715148 arp who-has 192.168.100.1 tell 192.168.100.10 627.715200 arp reply 192.168.100.1 is-at 0:9:f:b:90:3d 627.715365 192.168.100.10 -> 192.168.100.1: icmp: echo request

[rwpatterson]

Have you tried another device on the DMZ? You know, to rule out Windows. . .

[UkWizard]

If you can ping from the firewall to the pc, but not from the pc to the firewall, its probably the ping setting on the DMZ interface that is not turned on. Without that ticked, all ping requests will be dropped.

[#8]

Yes, I checked to make sure that PING was enabled on the DMZ port. It is enabled, but still doesn' t respond to a ping from the connected PC! Any other suggestions on why the DMZ port won' t respond to a ping? Also, the PC has started complaining again that there is an address conflict! I am going to try with a Linux box to see if there is any difference.

[#9]

I connected a Linux box directly to the DMZ port on the same IP subnet but the DMZ port still won' t respond to a ping!!

[UkWizard]

perform a ping, then look at the arp table on the pc (arp -a) see if the ip is listed and note the mac address, compare that to the fortinets actual mac address. If the same, then the firewall is definately blocking the ping. Maybe its time to think about reloading the config, and you could also go the latest revision of firmware. just in case. you are definately getting weird behaviour.

[#11]

Weird weird weird I queried the arp table on the PC - it was empty. I performed a ping from the PC - for which there is no response. I then queried the arp table on the PC again - and it shows an entry for the DMZ port. Comparison of the MAC address confirms it is the DMZ port. I will try to reload the configuration (I will do this off-hours) and upgrade the firmware to see if that makes any difference.