Firewall Policies not working as expected

[ABE_63]

I have removed two physical interfaces (internal2 and internal3) from the internal interface. I gave internal2 192.168.10.1/24 and internal3 192.168.20.1/24. I connected a device to port 2 and gave it the IP address 192.168.10.10/24. I plugged another device into internal3 and gave it 192.168.20.10. I made sure each device could ping it's own gateway .1 address. I then tried to ping the opposite IP gateway which as expected did not work. I then created a firewall policy called 10 to 20, Inc int: internal2, Out int: internal3, source: all, destination: all, service: all. Action: accept. Apart from disabling NAT and setting the logging to All Sessions (which doesn't seem to be logging anything by the way, but that's a separate issue) everything else was left as default. Yet I can't seem to ping one device from another. I can't even ping the opposite gateway. What am I doing wrong?

[Toshi_Esumi · Accepted solution]

Make sure you have two policies from internal2 to internal3 and from internal3 to internal2.
Try sniffing 'any' interface for icmp, then ping from one side to the other. Like...
diag sniffer packet any 'icmp' 4 0 l (last letter is lower-case 'L')
You should see in and out packets on both interfaces.

For the log issue, you should see even the ping sessions in Log&Report->Forward Traffic if you ping "through" the FGT.

Toshi

[Toshi_Esumi · Accepted solution]

Make sure you have two policies from internal2 to internal3 and from internal3 to internal2.
Try sniffing 'any' interface for icmp, then ping from one side to the other. Like...
diag sniffer packet any 'icmp' 4 0 l (last letter is lower-case 'L')
You should see in and out packets on both interfaces.

For the log issue, you should see even the ping sessions in Log&Report->Forward Traffic if you ping "through" the FGT.

Toshi

[ABE_63]

I have a ping now but the Log&Report->Forward Traffic is empty. Any ideas why this isn't working?

[Toshi_Esumi]

Are you pinging through the FGT from one interface to the other to an actual device?
You're logging onto and viewing on memory log, right?

Toshi

[ABE_63]

I'm starting to see some traffic come in now. There was a delay of around 5 minutes for some reason.

I have managed to setup a remote access VPN connection and now I am trying to prove I can also ping internal3 wehn connected from the client address range "10.50.50.1-10.50.50.20. I ran your command "diag sniffer packet any 'test_IPSec_VPN' 4 0 l " on the tunnel interface (test_IPSec_VPN) and can see the pings are going to internal3, however, when i run your command on internal3 interface, nothing is being received. Firewall policy the wizard created is as follows:

Inc int: test_IPSec_VPN,

Out int: internal3,

source: test_IPSec_VPN_range (selected user tab and chose user test_user), destination: all,

service: all.

Action: accept

[dbhavsar]

Hi @ABE_63 ,

- for that can you disable npu-offload on the IPSec interface and auto-asic-offload on the policy. Also make sure for the policy that IPSec wizard created all sessions are being logged.

[ABE_63]

Interesting I will look into this thanks.

[Toshi_Esumi]

Your command shouldn't work if you put 'test_IPSec_VPN' in the sniffer(tcpdump) filters between single quotes. The avilable options are like in this article.
https://infosecmonkey.com/quick-tip-how-to-run-sniffer-on-fortigate-cli/

Toshi

[ABE_63 · Accepted solution]

The fix to the IPsec firewall issue I had to remove the user from the Source field of the firewall policy.