Dual WAN LINK interface administration

[#1]

Hi all, I already set up 2 WAN link and its working (able to browse internet ), I am only able to access WAN1 administrative webaccess but WAN2, I' m unable to do so. I have set equal distance (5) in the static route for both of the WAN Link and also enable administrative access to both of the WAN link either http and https. What other steps that I miss out? Thank you all.

[g3rman]

Are you trying to access your WAN2 management interface from the inside or Internet?

[#3]

Hi, I am trying to access it from Internet

[#4]

Hello august_twenty8, Can you check if both default routes are in the routing table ; from CLI : " get router info routing-table all" Jabo.

[#5]

This is what I get S* 0.0.0.0/0 [5/0] via 219.a.b.c, wan1 [5/0] via 219.d.e.f, wan2 192.168.10.0/24 is directly connected, internal 192.168.254.0/24 [10/0] is directly connected, ssl.root 219.a.b.c/29 is directly connected, wan1 219.d.e.f/29 is directly connected, wan2

[g3rman]

On the command line you can run: diag sniffer packet wan2 ' port 443' Then test from the outside and see if you see any incoming packets to your Fortinet. I had an issue with someone else yesterday and their WAN1 ISP was filtering out packets whereas on WAN2 they were not.

[#7]

When enter the $ diag sniffer packet wan2 " port 443" and I ping to the interface it return me nothing. but when I telnet it 443 it return me this result 165.060076 59.108.29.151.443 -> 219.95.111.222.1060: syn 2523256685 ack 3592316543 165.060220 219.95.111.222.1060 -> 59.108.29.151.443: ack 2523256686 165.064246 219.95.111.222.1060 -> 59.108.29.151.443: psh 3592316543 ack 2523256686 165.144222 59.108.29.151.443 -> 219.95.111.222.1060: ack 3592316652 165.157043 59.108.29.151.443 -> 219.95.111.222.1060: 2523256686 ack 3592316652 165.157177 219.95.111.222.1060 -> 59.108.29.151.443: ack 2523258134

[g3rman]

To see pings also you will need this: diag sniffer packet wan2 ' port 443 and icmp' But the SSL stuff looks good. In your Admin profile are you restricting access from specific hosts are are your admins set to 0.0.0.0/0.0.0.0 for all trusted hosts?

[#9]

In my Admin > Administrators , Trusted Hosts 0.0.0.0/0 0.0.0.0/0 0.0.0.0/0, when i enter $diag sniffer packet wan2 " port 443 and icmp" interfaces=[wan2] filters=[port 443 and icmp] pcap_compile: expression rejects all packets $diag sniffer packet wan2 " port 443 or icmp" It return me 163.169708 219.a.b.222 -> 202.188.0.133: icmp: echo request 163.173185 202.188.0.133 -> 219.a.b.222: icmp: echo reply 168.209592 219.a.b.222 -> 202.188.0.133: icmp: echo request 168.223087 202.188.0.133 -> 219.a.b.222: icmp: echo reply I think the I already set ping server into wan2 and also wan1 .. 202.188.0.133 is the dns that i point my ping server to ping For ping server what next hop router should we put, is it alright if I keep pinging the dns server?

[dbsanders]

I am having the same issue. Just hooked up WAN2 on a 200A and I cannot get HTTPS Admin working on that interface. The packets are seen coming to WAN2 but are not being accepted.

 fort01 # diag sniffer packet any ' port 443 and host 8.7.25.18' 
 
 interfaces=[any]
 
 filters=[port 443 and host 8.7.25.23]
 
 4.212088 8.7.25.18.57378 -> 71.118.12.84.443: syn 3797564345 
 7.215133 8.7.25.18.57378 -> 71.118.12.84.443: syn 3797564345 
 13.204260 8.7.25.18.57378 -> 71.118.12.84.443: syn 3797564345
 25.202414 8.7.25.18.57378 -> 71.118.12.84.443: syn 3797564345
 49.199476 8.7.25.18.57378 -> 71.118.12.84.443: syn 3797564345 
 
 5 packets received by filter
 0 packets dropped by kernel
 

 S*      0.0.0.0/0 [1/0] via 65.214.187.49, wan1
 C       10.0.0.0/23 is directly connected, internal
 C       10.0.5.0/24 is directly connected, dmz2
 S       10.10.20.100/30 [2/0] is directly connected, ssl.root
 S       10.10.20.104/29 [2/0] is directly connected, ssl.root
 S       10.10.20.112/28 [2/0] is directly connected, ssl.root
 S       10.10.20.128/26 [2/0] is directly connected, ssl.root
 S       10.10.20.192/29 [2/0] is directly connected, ssl.root
 S       10.10.20.200/32 [2/0] is directly connected, ssl.root
 C       65.214.187.48/28 is directly connected, wan1
 C       71.118.12.0/24 is directly connected, wan2
 

Will not answer pings either.

 fort01 # diag sniffer packet wan2 ' host 8.7.25.181' 
 
 interfaces=[wan2]
 
 filters=[host 8.7.25.181]
 
 7.832028 8.7.25.181 -> 71.118.12.84: icmp: echo request
 8.833358 8.7.25.181 -> 71.118.12.84: icmp: echo request
 9.832492 8.7.25.181 -> 71.118.12.84: icmp: echo request
 10.832368 8.7.25.181 -> 71.118.12.84: icmp: echo request
 11.832966 8.7.25.181 -> 71.118.12.84: icmp: echo request
 12.832088 8.7.25.181 -> 71.118.12.84: icmp: echo request
 
 6 packets received by filter
 0 packets dropped by kernel