Fortigate 100A Issues

[tstrip007]

I have been given a 3mb link with 4 usable ip's. I have hooked this link into the WAN int 1. I have my local interface plugged in and can access the admin GUI.

I have created a static route with a wildcard ip and subnet mask and the gateway of this 3mb link.

I have created a virtual IP and assigned one of the 4 usable ip's that maps to an internal ip (webserver) however I cannot get this ip to ping from the outside. I have created a policy and assigned the virtual ip to the policy.

Cannot figure out why its only the wan interface and the gateway I can ping for this 3mb link. If I change the wan Ip to one of the other 4 usables it pings.

Any advice? this is mainly for inbound traffic. I have several other firewalls in my environment.

[ede_pfau]

hello,

and welcome to the forums.

You haven't mentioned it but chances are that your VIP is port-forwarding. As such it will not forward (port-less) ICMP. If the VIP is 1:1 then it should relay the ping.

BTW, which OS version?

[rwpatterson]

tstrip007 wrote:

I have created a static route with a wildcard ip and subnet mask and the gateway of this 3mb link.

This is confusing. The default route should be from inside to outside, and if that's the case, the next hop should be the local inside interface IP of the Fortigate (not the gateway of "this 3mb link"). Also you need the correct policies in place to make all this happen.

edit - I was assuming you were referring to traffic from the inside out. After rereading I see you are referring to the FGT itself. Check your PING options from the CLI. Chances are it's set to the incorrect source IP address.

[tstrip007]

Yah I am only concerned with outside world being able to get in. I am using fg100a-v4.0,build0328,110718 (MR2 Patch 8).

I dont have any port forwarding on the VIP, only mapped to an external. I have a special policy setup to where inbound can only come in on a specific port.

Ill check ping options....

[tstrip007]

Not really sure what Im looking for with the ping options I did the following from CLI with my wan ip

execute ping-option repeat-count 3 execute ping-option source my.wan.ip.0 execute ping-option view-settings    

[ede_pfau]

Nope, wrong heading...you're pinging from the outside to the VIP address. ICMP, the protocol ping uses, is port-less. If either your VIP or the policy doesn't allow ALL traffic the FGT won't be able to answer.

Have you checked whether you get a connection on the port which you have configured? ping itself may be a help often but not in this case.

[tstrip007]

Ugh, im sorry, yes the IP was the vip address not my wan ip. I get a response from the CLI but no response from the outside ping. Yah, I have a policy that allows all with the vip assigned to that policy. Still nothing from the outside. I can only ping the gateway and wan ip from the outside.

[ede_pfau]

My question was: do you get a response using the intended service? ping cannot work if you either port-forward (which you don't) or if you won't allow it in the policy.

[tstrip007]

Ah. Sorry, no I dont. I have given the VIP ip a domain name and tried webposting through the allowed port and it does not work. Ive even tried modifying the vip to portforward to a special port and added in rdp access to the service to see if I could rdp into the webserver via public address:port ...nothing.

[rwpatterson]

Here's a really long shot. Do you have an IP pool covering the same IP address? An IP Pool will make any IP in that range turn into a black hole. Anywhere else on the FGT using that IP, traffic will die a quiet death. (Ask me how I know...)