FG100F LAN interface traffic

[yeowkm99]

i have one new FG100F running on FortiOS 7.2.5.

i noticed that there is some issues using the firewall LAN IP, 172.32.xx.1.

i can ping the LAN IP from same subnets or other subnets but i cannot ping from the LAN IP of the firewall to other IP address.

i also tried adding this firewall to my log Analyzer for syslog logging but no traffic from the firewall to the syslog server.

all the polices are already created to and from the firewall LAN IP. 

[Patterson]

 Hi @yeowkm99 

Based on the update, I understand that from Firewall Lan IP as a source your not able to ping other network. 

Also when you mentioned  that from Lan to Lan reachability is fine, Was this validated from both direction?  Is Nat enabled on these firewall policy ?

The other subnet is connected network or remote subnet ?

Regards,

Patterson

[yeowkm99]

both direction is working. only firewall LAN IP cannot ping to others.

port 3 is my firewall LAN connection.

[srajeswaran]

Can you run a diag sniffer from CLI while you initiate a ping towards the syslog server?

diagnose sniffer packet any "host 172.32.xx.1" 4 100

This will help us to confirm if the packet is leaving or not, also if it is taking the right source address or not

[yeowkm99]

interfaces=[any]
filters=[host 172.32.0.1]
0.066329 lan in arp who-has 172.32.0.1 tell 172.32.0.5
0.066356 lan out arp reply 172.32.0.1 is-at 84:39:8f:a7:60:2f
0.077448 To_TMC in 172.20.0.124.60372 -> 172.32.0.1.22: ack 831914144
1.059736 To_TMC out 172.32.0.1.22 -> 172.20.0.124.60372: psh 831914144 ack 3578922795
1.059820 To_TMC out 172.32.0.1.22 -> 172.20.0.124.60372: psh 831914256 ack 3578922795
1.074030 To_TMC in 172.20.0.124.60372 -> 172.32.0.1.22: ack 831914448
2.069649 To_TMC out 172.32.0.1.22 -> 172.20.0.124.60372: psh 831914448 ack 3578922795
2.145546 To_TMC in 172.20.0.124.60372 -> 172.32.0.1.22: ack 831914752
3.079601 To_TMC out 172.32.0.1.22 -> 172.20.0.124.60372: psh 831914752 ack 3578922795
3.149677 To_TMC in 172.20.0.124.60372 -> 172.32.0.1.22: ack 831914976
3.369339 To_TMC in 172.20.0.124.60573 -> 172.32.0.1.443: psh 697708298 ack 4118253871
3.369384 To_TMC out 172.32.0.1.443 -> 172.20.0.124.60573: ack 697708383
3.377076 To_TMC out 172.32.0.1.443 -> 172.20.0.124.60573: psh 4118253871 ack 697708383
3.380025 To_TMC out 172.32.0.1.443 -> 172.20.0.124.60573: psh 4118254459 ack 697708383
3.405730 To_TMC in 172.20.0.124.60573 -> 172.32.0.1.443: psh 697708383 ack 4118254459
3.439436 To_TMC out 172.32.0.1.443 -> 172.20.0.124.60573: ack 697708418
3.456619 To_TMC in 172.20.0.124.60573 -> 172.32.0.1.443: ack 4118254490
4.089792 To_TMC out 172.32.0.1.22 -> 172.20.0.124.60372: psh 831914976 ack 3578922795
4.158045 To_TMC in 172.20.0.124.60372 -> 172.32.0.1.22: ack 831915776
5.099699 To_TMC out 172.32.0.1.22 -> 172.20.0.124.60372: psh 831915776 ack 3578922795
5.157274 To_TMC in 172.20.0.124.60372 -> 172.32.0.1.22: ack 831916000
6.119631 To_TMC out 172.32.0.1.22 -> 172.20.0.124.60372: psh 831916000 ack 3578922795
6.140275 To_TMC in 172.20.0.124.60372 -> 172.32.0.1.22: psh 3578922795 ack 831916224
6.140416 To_TMC out 172.32.0.1.22 -> 172.20.0.124.60372: psh 831916224 ack 3578922955
6.195527 To_TMC in 172.20.0.124.60372 -> 172.32.0.1.22: ack 831916272
6.286312 lan in arp who-has 172.32.0.1 (84:39:8f:a7:60:2f) tell 172.32.0.57
6.286335 lan out arp reply 172.32.0.1 is-at 84:39:8f:a7:60:2f
7.129690 To_TMC out 172.32.0.1.22 -> 172.20.0.124.60372: psh 831916272 ack 3578922955
7.194823 To_TMC in 172.20.0.124.60372 -> 172.32.0.1.22: ack 831916800
8.139669 To_TMC out 172.32.0.1.22 -> 172.20.0.124.60372: psh 831916800 ack 3578922955
8.206527 To_TMC in 172.20.0.124.60372 -> 172.32.0.1.22: ack 831917024
8.529382 lan out arp who-has 172.32.0.30 tell 172.32.0.1
8.529502 lan in arp reply 172.32.0.30 is-at 4c:d9:8f:91:7d:4a
9.129226 lan in arp who-has 172.32.0.1 (84:39:8f:a7:60:2f) tell 172.32.0.30
9.129248 lan out arp reply 172.32.0.1 is-at 84:39:8f:a7:60:2f
9.129522 To_TMC out 172.32.0.1.22 -> 172.20.0.124.60372: psh 831917024 ack 3578922955
9.129599 To_TMC out 172.32.0.1.22 -> 172.20.0.124.60372: psh 831917296 ack 3578922955
9.142283 To_TMC in 172.20.0.124.60372 -> 172.32.0.1.22: ack 831917424
9.366546 To_TMC in 172.20.0.124.60573 -> 172.32.0.1.443: psh 697708418 ack 4118254490
9.366583 To_TMC out 172.32.0.1.443 -> 172.20.0.124.60573: ack 697708503
9.374221 To_TMC out 172.32.0.1.443 -> 172.20.0.124.60573: psh 4118254490 ack 697708503
9.374989 To_TMC out 172.32.0.1.443 -> 172.20.0.124.60573: psh 4118255078 ack 697708503
9.387284 To_TMC in 172.20.0.124.60573 -> 172.32.0.1.443: ack 4118255109
9.392013 To_TMC in 172.20.0.124.60573 -> 172.32.0.1.443: psh 697708503 ack 4118255109
9.429381 To_TMC out 172.32.0.1.443 -> 172.20.0.124.60573: ack 697708538
10.139593 To_TMC out 172.32.0.1.22 -> 172.20.0.124.60372: psh 831917424 ack 3578922955
10.139679 To_TMC out 172.32.0.1.22 -> 172.20.0.124.60372: psh 831917616 ack 3578922955
10.139737 To_TMC out 172.32.0.1.22 -> 172.20.0.124.60372: psh 831917856 ack 3578922955
10.139794 To_TMC out 172.32.0.1.22 -> 172.20.0.124.60372: psh 831918320 ack 3578922955
10.139845 To_TMC out 172.32.0.1.22 -> 172.20.0.124.60372: psh 831918544 ack 3578922955
10.150096 To_TMC in 172.20.0.124.60372 -> 172.32.0.1.22: ack 831917856
10.150135 To_TMC in 172.20.0.124.60372 -> 172.32.0.1.22: ack 831918544
10.189253 To_TMC in 172.20.0.124.60372 -> 172.32.0.1.22: ack 831918672
^C

[srajeswaran]

I see ARP request/reply,were you pinging 172.32.0.30? do you have any local-in policies in place?

8.529382 lan out arp who-has 172.32.0.30 tell 172.32.0.1
8.529502 lan in arp reply 172.32.0.30 is-at 4c:d9:8f:91:7d:4a
9.129226 lan in arp who-has 172.32.0.1 (84:39:8f:a7:60:2f) tell 172.32.0.30
9.129248 lan out arp reply 172.32.0.1 is-at 84:39:8f:a7:60:2f

[yeowkm99]

172.32.0.30 is one of the servers in the subnet.

how do i check for local-in policies

[Toshi_Esumi]

show firewall local-in-policy

Toshi

[yeowkm99]

nothing configured here.

show firewall local-in-policy
config firewall local-in-policy
end

[tthrilok]

Hi Yeowkm99,

Could you cross check if there is a IP duplicacy, you may verify the ARP entry on the user/lan machine for the firewall ip, are you seeing the firewall MAC address?

You can get the mac address of the firewall using below command:

di hardware deviceinfo nic <port>

Thank you!