Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
it-sbhk
New Contributor

FGT60F's Fixed IP WAN Line not work

FGT60F has two WAN lines.

  • WAN1 Fixed IP: NOT WORK
  • WAN2 Dynamic IP: Normal
  • Firmware 7.4.3

 

Reviewed the configuration with FWF60D to test WAN1

 

It is the same WAN1 setting. FWF60D is normal:

  • It can ping 8.8.8.8
  • Outsite can ping the Fixed IP

Confirm the Fixed IP line normal


When set FGT60F's WAN1 to be dynamic IP, the WAN1 can ping another device that can ping back FGT60F

 

Not sure why Fixed IP fails but Dynamic IP works on FGT60F


WAN1: Dynamic

exec ping-option reset


exec ping-option interface wan1

 

exec ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=0 ttl=58 time=1.7 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=58 time=1.4 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=58 time=1.4 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=58 time=1.4 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=58 time=1.4 ms

--- 8.8.8.8 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 1.4/1.4/1.7 ms


WAN1: Fixed
exec ping-option reset

 

exec ping-option interface wan1

 

exec ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
sendmsg failed: 101(Network is unreachable)
sendmsg failed: 101(Network is unreachable)
sendmsg failed: 101(Network is unreachable)
sendmsg failed: 101(Network is unreachable)
sendmsg failed: 101(Network is unreachable)

--- 8.8.8.8 ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss

 


WAN2: Dynamic
exec ping-option reset

 

exec ping-option interface wan2

 

exec ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=0 ttl=59 time=2.8 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=59 time=3.1 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=59 time=2.9 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=59 time=2.8 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=59 time=2.9 ms

--- 8.8.8.8 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 2.8/2.9/3.1 ms

 

#FortiGate60F

1 Solution
hbac

@it-sbhk,

 

Obviously, your wan1 default route is not active because it has higher administrative distance. Both default routes should have the same distance. Please refer to https://community.fortinet.com/t5/FortiGate/Technical-Tip-Adding-new-DHCP-addressing-mode-wan-connec...

 

Routing table for VRF=0
S 0.0.0.0/0 [15/0] via FIXED.IP.123.105, wan1, [1/0]
S *> 0.0.0.0/0 [5/0] via DHCP.IP.161.1, wan2, [1/0]

 

Regards, 

View solution in original post

10 REPLIES 10
AEK
Honored Contributor

When dynamic I guess your routing table is updated with a new default gateway.

When static did you try set this gateway manually?

AEK
AEK
it-sbhk
New Contributor

Thanks! The same setting between FGT60F (production) & FWF60D (test) on

  • config system interface
  • config router static

FWF60D works but the FGT60F does not work on the Fixed IP line. So, currently, we need to change the primary line to the WAN2 (dynamic) on FGT60F.

hbac

Hi @it-sbhk,

 

Make sure both default routes have the same administrative distance. You can run 'get router info routing-table database' to verify. By default, dynamic has distance of 5 and static has distance of 10. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Static-route-confusion-while-using-DHCP-on...

 

Regards, 

it-sbhk
New Contributor

Thanks! Have run 'get router info routing-table database', not find any special info. When Fixed IP does not work but DHCP works on the FGT60F. So, currently, going to run GNS3 to emulate the environment. Try to find if any specials 

jera

Hello @it-sbhk ,

 

Is it possible for you to share the output of 'get router info routing-table database' you can blur /cover/change the public IP before posting for security.

 

What is the previous version of your 60D and do you happen to configure any IP POOL?

JE
ebilcari

If it's not a routing problem, it may be an ARP inspection issue caused by the device where the WAN1 is connected. When you set the static IP can you ping the next hop IP of that subnet?

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
hbac

@it-sbhk.,

 

Can you share the output? Do you see both default routes as active routes?

 

Regards, 

it-sbhk
New Contributor

Thanks for your support!

 

FGT60F (Production): 7.4.3: FIXED.IP.123.106

 

FWF60D (Test): 6.0.16

 

ISP Gateway of the Fixed IP Line: FIXED.IP.123.105

 

----

 

My workstation form another office:

  • Have set FGT60F to allow ping
  • Workstation can ping the ISP's gateway
  • But cannot ping the FW

ping -c 10 FIXED.IP.123.106
PING FIXED.IP.123.106 (FIXED.IP.123.106) 56(84) bytes of data.

--- FIXED.IP.123.106 ping statistics ---
10 packets transmitted, 0 received, 100% packet loss, time 9216ms

 

ping -c 10 FIXED.IP.123.105
PING FIXED.IP.123.105 (FIXED.IP.123.105) 56(84) bytes of data.
64 bytes from FIXED.IP.123.105: icmp_seq=1 ttl=63 time=8.01 ms
64 bytes from FIXED.IP.123.105: icmp_seq=2 ttl=63 time=4.09 ms
64 bytes from FIXED.IP.123.105: icmp_seq=3 ttl=63 time=6.97 ms
64 bytes from FIXED.IP.123.105: icmp_seq=4 ttl=63 time=4.48 ms
64 bytes from FIXED.IP.123.105: icmp_seq=5 ttl=63 time=4.37 ms
64 bytes from FIXED.IP.123.105: icmp_seq=6 ttl=63 time=4.51 ms
64 bytes from FIXED.IP.123.105: icmp_seq=7 ttl=63 time=4.10 ms
64 bytes from FIXED.IP.123.105: icmp_seq=8 ttl=63 time=4.70 ms
64 bytes from FIXED.IP.123.105: icmp_seq=9 ttl=63 time=4.68 ms
64 bytes from FIXED.IP.123.105: icmp_seq=10 ttl=63 time=3.88 ms

--- FIXED.IP.123.105 ping statistics ---
10 packets transmitted, 10 received, 0% packet loss, time 9028ms
rtt min/avg/max/mdev = 3.883/4.979/8.007/1.299 ms

 

----

 

FGT60F:

  • FW can ping the Gateway
  • But cannot ping to Google and anywhere

get router info routing-table database
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
V - BGP VPNv4
> - selected route, * - FIB route, p - stale info

Routing table for VRF=0
S 0.0.0.0/0 [15/0] via FIXED.IP.123.105, wan1, [1/0]
S *> 0.0.0.0/0 [5/0] via DHCP.IP.161.1, wan2, [1/0]
C *> FIXED.IP.123.104/30 is directly connected, wan1
C *> DHCP.IP.161.0/24 is directly connected, wan2

 

exec ping-option reset
exec ping-option interface wan1

 

exec ping google.com
PING google.com (172.217.175.78): 56 data bytes
sendmsg failed: 101(Network is unreachable)
sendmsg failed: 101(Network is unreachable)
sendmsg failed: 101(Network is unreachable)
sendmsg failed: 101(Network is unreachable)
sendmsg failed: 101(Network is unreachable)

--- google.com ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss

 

exec ping FIXED.IP.123.105
PING FIXED.IP.123.105 (FIXED.IP.123.105): 56 data bytes
64 bytes from FIXED.IP.123.105: icmp_seq=0 ttl=255 time=0.9 ms
64 bytes from FIXED.IP.123.105: icmp_seq=1 ttl=255 time=2.0 ms
64 bytes from FIXED.IP.123.105: icmp_seq=2 ttl=255 time=0.9 ms
64 bytes from FIXED.IP.123.105: icmp_seq=3 ttl=255 time=0.8 ms
64 bytes from FIXED.IP.123.105: icmp_seq=4 ttl=255 time=16.0 ms

--- FIXED.IP.123.105 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 0.8/4.1/16.0 ms

hbac

@it-sbhk,

 

Obviously, your wan1 default route is not active because it has higher administrative distance. Both default routes should have the same distance. Please refer to https://community.fortinet.com/t5/FortiGate/Technical-Tip-Adding-new-DHCP-addressing-mode-wan-connec...

 

Routing table for VRF=0
S 0.0.0.0/0 [15/0] via FIXED.IP.123.105, wan1, [1/0]
S *> 0.0.0.0/0 [5/0] via DHCP.IP.161.1, wan2, [1/0]

 

Regards, 

Labels
Top Kudoed Authors