FGT60F's Fixed IP WAN Line not work

[it-sbhk]

FGT60F has two WAN lines.

• WAN1 Fixed IP: NOT WORK
• WAN2 Dynamic IP: Normal
• Firmware 7.4.3

Reviewed the configuration with FWF60D to test WAN1

It is the same WAN1 setting. FWF60D is normal:

• It can ping 8.8.8.8
• Outsite can ping the Fixed IP

Confirm the Fixed IP line normal

When set FGT60F's WAN1 to be dynamic IP, the WAN1 can ping another device that can ping back FGT60F

Not sure why Fixed IP fails but Dynamic IP works on FGT60F

WAN1: Dynamic

exec ping-option reset

exec ping-option interface wan1

exec ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=0 ttl=58 time=1.7 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=58 time=1.4 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=58 time=1.4 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=58 time=1.4 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=58 time=1.4 ms

--- 8.8.8.8 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 1.4/1.4/1.7 ms

WAN1: Fixed
exec ping-option reset

exec ping-option interface wan1

exec ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
sendmsg failed: 101(Network is unreachable)
sendmsg failed: 101(Network is unreachable)
sendmsg failed: 101(Network is unreachable)
sendmsg failed: 101(Network is unreachable)
sendmsg failed: 101(Network is unreachable)

--- 8.8.8.8 ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss

WAN2: Dynamic
exec ping-option reset

exec ping-option interface wan2

exec ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=0 ttl=59 time=2.8 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=59 time=3.1 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=59 time=2.9 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=59 time=2.8 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=59 time=2.9 ms

--- 8.8.8.8 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 2.8/2.9/3.1 ms

#FortiGate60F

[AEK]

When dynamic I guess your routing table is updated with a new default gateway.

When static did you try set this gateway manually?

[it-sbhk]

Thanks! The same setting between FGT60F (production) & FWF60D (test) on

• config system interface
• config router static

FWF60D works but the FGT60F does not work on the Fixed IP line. So, currently, we need to change the primary line to the WAN2 (dynamic) on FGT60F.

[hbac]

Hi @it-sbhk,

Make sure both default routes have the same administrative distance. You can run 'get router info routing-table database' to verify. By default, dynamic has distance of 5 and static has distance of 10. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Static-route-confusion-while-using-DHCP-on...

Regards, 

[it-sbhk]

Thanks! Have run 'get router info routing-table database', not find any special info. When Fixed IP does not work but DHCP works on the FGT60F. So, currently, going to run GNS3 to emulate the environment. Try to find if any specials 

[jera]

Hello @it-sbhk ,

Is it possible for you to share the output of 'get router info routing-table database' you can blur /cover/change the public IP before posting for security.

What is the previous version of your 60D and do you happen to configure any IP POOL?

[ebilcari]

If it's not a routing problem, it may be an ARP inspection issue caused by the device where the WAN1 is connected. When you set the static IP can you ping the next hop IP of that subnet?

[hbac]

@it-sbhk.,

Can you share the output? Do you see both default routes as active routes?

Regards, 

[it-sbhk]

Thanks for your support!

FGT60F (Production): 7.4.3: FIXED.IP.123.106

FWF60D (Test): 6.0.16

ISP Gateway of the Fixed IP Line: FIXED.IP.123.105

----

My workstation form another office:

• Have set FGT60F to allow ping
• Workstation can ping the ISP's gateway
• But cannot ping the FW

ping -c 10 FIXED.IP.123.106
PING FIXED.IP.123.106 (FIXED.IP.123.106) 56(84) bytes of data.

--- FIXED.IP.123.106 ping statistics ---
10 packets transmitted, 0 received, 100% packet loss, time 9216ms

ping -c 10 FIXED.IP.123.105
PING FIXED.IP.123.105 (FIXED.IP.123.105) 56(84) bytes of data.
64 bytes from FIXED.IP.123.105: icmp_seq=1 ttl=63 time=8.01 ms
64 bytes from FIXED.IP.123.105: icmp_seq=2 ttl=63 time=4.09 ms
64 bytes from FIXED.IP.123.105: icmp_seq=3 ttl=63 time=6.97 ms
64 bytes from FIXED.IP.123.105: icmp_seq=4 ttl=63 time=4.48 ms
64 bytes from FIXED.IP.123.105: icmp_seq=5 ttl=63 time=4.37 ms
64 bytes from FIXED.IP.123.105: icmp_seq=6 ttl=63 time=4.51 ms
64 bytes from FIXED.IP.123.105: icmp_seq=7 ttl=63 time=4.10 ms
64 bytes from FIXED.IP.123.105: icmp_seq=8 ttl=63 time=4.70 ms
64 bytes from FIXED.IP.123.105: icmp_seq=9 ttl=63 time=4.68 ms
64 bytes from FIXED.IP.123.105: icmp_seq=10 ttl=63 time=3.88 ms

--- FIXED.IP.123.105 ping statistics ---
10 packets transmitted, 10 received, 0% packet loss, time 9028ms
rtt min/avg/max/mdev = 3.883/4.979/8.007/1.299 ms

----

FGT60F:

• FW can ping the Gateway
• But cannot ping to Google and anywhere

get router info routing-table database
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
V - BGP VPNv4
> - selected route, * - FIB route, p - stale info

Routing table for VRF=0
S 0.0.0.0/0 [15/0] via FIXED.IP.123.105, wan1, [1/0]
S *> 0.0.0.0/0 [5/0] via DHCP.IP.161.1, wan2, [1/0]
C *> FIXED.IP.123.104/30 is directly connected, wan1
C *> DHCP.IP.161.0/24 is directly connected, wan2

exec ping-option reset
exec ping-option interface wan1

exec ping google.com
PING google.com (172.217.175.78): 56 data bytes
sendmsg failed: 101(Network is unreachable)
sendmsg failed: 101(Network is unreachable)
sendmsg failed: 101(Network is unreachable)
sendmsg failed: 101(Network is unreachable)
sendmsg failed: 101(Network is unreachable)

--- google.com ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss

exec ping FIXED.IP.123.105
PING FIXED.IP.123.105 (FIXED.IP.123.105): 56 data bytes
64 bytes from FIXED.IP.123.105: icmp_seq=0 ttl=255 time=0.9 ms
64 bytes from FIXED.IP.123.105: icmp_seq=1 ttl=255 time=2.0 ms
64 bytes from FIXED.IP.123.105: icmp_seq=2 ttl=255 time=0.9 ms
64 bytes from FIXED.IP.123.105: icmp_seq=3 ttl=255 time=0.8 ms
64 bytes from FIXED.IP.123.105: icmp_seq=4 ttl=255 time=16.0 ms

--- FIXED.IP.123.105 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 0.8/4.1/16.0 ms

[hbac · Accepted solution]

@it-sbhk,

Obviously, your wan1 default route is not active because it has higher administrative distance. Both default routes should have the same distance. Please refer to https://community.fortinet.com/t5/FortiGate/Technical-Tip-Adding-new-DHCP-addressing-mode-wan-connec...

Routing table for VRF=0
S 0.0.0.0/0 [15/0] via FIXED.IP.123.105, wan1, [1/0]
S *> 0.0.0.0/0 [5/0] via DHCP.IP.161.1, wan2, [1/0]

Regards,