Fortigate 200B Unable to connect to Branch Office MPLS

[jaiganeshbsc]

I have a fortigate 200B. Internal network (switch) is setup with 192.168.1.x. 1 WAN link with Internet connected to port 9. In this setup everything is working fine. Now have to connect with HO via MPLS. Which is connected to port 10 with IP 10.202.96.2 and Gateway for the same is 10.202.96.1.

I have created policies to allow communication to and from port 10 & switch.

When pinging from within the Fortigate CLI I can ping the port 10 interface IP 10.202.96.2 as well as the MPLS Gateway 10.202.96.1.

I have even setup a secondary IP to the switch as 10.202.96.10. However from the switch interface I am not able to ping 10.202.96.2 (port 10) or the Gateway. Fortigate seems to drop packets to this subnet.

Please assist with the setup as I am new to Fortigate.

Thanks

Jaiganesh.

[Toshi_Esumi]

As in many threads in the past, if you can't ping an interface from the opposite side of the cable, it's because either 1) ping is not allowed on the interface, or 2) trusthosts are configured but don't include the IP you're pinging from.

[ede_pfau]

Search for "diag debug flow" in the forums and run it, then post.

[jaiganeshbsc]

Please find the below result when pinging the MPLS Gateway from within CLI keeping the source address as 192.168.1.1 (Interal)

FOrtigate  $ exec ping-options source 192.168.1.1   FOrtigate  $ exec ping 10.202.96.1 id=13 trace_id=31 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=1, 192.168.1.1:16896->10.202.96.1:8) from local. code=8, type=0, id=16896, seq=0." id=13 trace_id=31 func=init_ip_session_common line=4469 msg="allocate a new session-0037fecf" id=13 trace_id=32 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=1, 192.168.1.1:16896->10.202.96.1:8) from local. code=8, type=0, id=16896, seq=256." id=13 trace_id=32 func=resolve_ip_tuple_fast line=4372 msg="Find an existing session, id-0037fecf, original direction" id=13 trace_id=33 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=1, 192.168.1.1:16896->10.202.96.1:8) from local. code=8, type=0, id=16896, seq=512." id=13 trace_id=33 func=resolve_ip_tuple_fast line=4372 msg="Find an existing session, id-0037fecf, original direction" id=13 trace_id=34 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=1, 192.168.1.1:16896->10.202.96.1:8) from local. code=8, type=0, id=16896, seq=768." id=13 trace_id=34 func=resolve_ip_tuple_fast line=4372 msg="Find an existing session, id-0037fecf, original direction" id=13 trace_id=35 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=1, 192.168.1.1:16896->10.202.96.1:8) from local. code=8, type=0, id=16896, seq=1024." id=13 trace_id=35 func=resolve_ip_tuple_fast line=4372 msg="Find an existing session, id-0037fecf, original direction" PING 10.202.96.1 (10.202.96.1): 56 data bytes   --- 10.202.96.1 ping statistics --- 5 packets transmitted, 0 packets received, 100% packet loss

Appreciate any possible help resolving this connectivity issue.

Nilgirs_HO_UTM $ exec ping-options source 192.168.1.1

 

Nilgirs_HO_UTM $ exec ping 10.202.96.1

id=13 trace_id=31 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=1, 192.168.1.1:16896->10.202.96.1:8) from local. code=8, type=0, id=16896, seq=0."

id=13 trace_id=31 func=init_ip_session_common line=4469 msg="allocate a new session-0037fecf"

id=13 trace_id=32 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=1, 192.168.1.1:16896->10.202.96.1:8) from local. code=8, type=0, id=16896, seq=256."

id=13 trace_id=32 func=resolve_ip_tuple_fast line=4372 msg="Find an existing session, id-0037fecf, original direction"

id=13 trace_id=33 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=1, 192.168.1.1:16896->10.202.96.1:8) from local. code=8, type=0, id=16896, seq=512."

id=13 trace_id=33 func=resolve_ip_tuple_fast line=4372 msg="Find an existing session, id-0037fecf, original direction"

id=13 trace_id=34 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=1, 192.168.1.1:16896->10.202.96.1:8) from local. code=8, type=0, id=16896, seq=768."

id=13 trace_id=34 func=resolve_ip_tuple_fast line=4372 msg="Find an existing session, id-0037fecf, original direction"

id=13 trace_id=35 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=1, 192.168.1.1:16896->10.202.96.1:8) from local. code=8, type=0, id=16896, seq=1024."

id=13 trace_id=35 func=resolve_ip_tuple_fast line=4372 msg="Find an existing session, id-0037fecf, original direction"

PING 10.202.96.1 (10.202.96.1): 56 data bytes

 

--- 10.202.96.1 ping statistics ---

5 packets transmitted, 0 packets received, 100% packet loss