Fortigate GUI not opening

[rohittarang]

Hi all,

I have created a topology in the EVE-NG software where my FortiGate firewall is connected to a switch, and the switch is connected to the management cloud. Now I want to open my FortiGate firewall GUI in Chrome browser, but it’s not opening.

FortiGate port 5: 192.168.100.16

Gateway: 192.168.100.1

(If I remove the static IP from port 5 and set it to DHCP, I can open the FortiGate GUI via the DHCP IP in Chrome.)

Please help me.

[ozkanaltas]

Hi @rohittarang ,

Did you configure static route on Fortigate? 

[rohittarang]

Yes. I have configured Static route.

FW1 # get route info routing-table static
Routing table for VRF=0
S* 0.0.0.0/0 [10/0] via 192.168.100.1, port5, [1/0]

[ozkanaltas]

Hello @rohittarang ,

I think this issue related to Eve-ng environment. What happens if you manually give the IP address given by dhcp? Have you tried this before?

Also, can you run this sniffer command while trying access to GUI.

diagnose sniffer packet port5  

[rohittarang]

If I set port5 as dhcp and use that dhcp ip, then it's working. I can open gui via that dhcp ip. Received below reply by using sniffer command.

FW1 # diagnose sniffer packet port5
Using Original Sniffing Mode
interfaces=[port5]
filters=[none]
1.300988 arp who-has 192.168.100.1 tell 192.168.100.16
2.296860 arp who-has 192.168.100.1 tell 192.168.100.16
3.299165 arp who-has 192.168.100.1 tell 192.168.100.16
6.299592 arp who-has 192.168.100.1 tell 192.168.100.16
7.297451 arp who-has 192.168.100.1 tell 192.168.100.16
8.297475 arp who-has 192.168.100.1 tell 192.168.100.16
11.303673 arp who-has 192.168.100.1 tell 192.168.100.16
12.296704 arp who-has 192.168.100.1 tell 192.168.100.16
13.296837 arp who-has 192.168.100.1 tell 192.168.100.16
16.304994 arp who-has 192.168.100.1 tell 192.168.100.16
17.297083 arp who-has 192.168.100.1 tell 192.168.100.16

[ozkanaltas]

Hi @rohittarang ,

What I actually mean is this, for example, when you configure dhcp, dhcp gives you the IP address 192.168.100.50. Does anything change when you manually enter this address into port5?

However, it is interesting that EVE-NG does not respond to arp requests.

Also, can you put Fortigate into dhcp mode and check the gateway address coming from dhcp? Maybe EVE-NG is using the address 192.168.100.2.

[rohittarang]

Its opening via DHCP IP

FW1 # show system interface
name Name.
fortilink static 0.0.0.0 0.0.0.0 10.255.1.1 255.255.255.0 up disable aggregate enable
l2t.root static 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 up disable tunnel enable
naf.root static 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 up disable tunnel disable
port1 static 0.0.0.0 0.0.0.0 192.168.1.102 255.255.255.0 up disable physical enable
port2 static 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 up disable physical enable
port3 static 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 up disable physical enable
port4 static 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 up disable physical enable
port5 dhcp 0.0.0.0 0.0.0.0 192.168.198.130 255.255.255.0 up disable physical enable

[ozkanaltas]

Hi @rohittarang ,

Can you check the gateway IP address on GUI while port5 is configured with dhcp? You can check the gateway address on Network -> Interfaces -> Port5. 

get router info routing-table database

get router info routing-table all

[rohittarang]

FW1 # get router info routing-table database
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
V - BGP VPNv4
> - selected route, * - FIB route, p - stale info

Routing table for VRF=0
S *> 0.0.0.0/0 [5/0] via 192.168.198.2, port5, [1/0]
S 0.0.0.0/0 [10/0] via 192.168.100.1, port5, [1/0]
C *> 192.168.1.0/24 is directly connected, port1
C *> 192.168.198.0/24 is directly connected, port5

FW1 # get router info routing-table all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
V - BGP VPNv4
* - candidate default

Routing table for VRF=0
S* 0.0.0.0/0 [5/0] via 192.168.198.2, port5, [1/0]
C 192.168.1.0/24 is directly connected, port1
C 192.168.198.0/24 is directly connected, port5

[ozkanaltas]

Hi @rohittarang ,

I think the 192.168.100.0/24 network is not configured in eve-ng, so when you try to configure FortiGate in this way, eve-ng does not respond to arp requests.

As you can see, eve-ng distributes IP addresses from the 192.168.198.0/24 subnet. That's why you need to give an IP address from the 192.168.198.0/24 subnet and enter 192.168.198.2 as the static route.

port5 dhcp 0.0.0.0 0.0.0.0 192.168.198.130 255.255.255.0 up disable physical enable

S *> 0.0.0.0/0 [5/0] via 192.168.198.2, port5, [1/0]

Or you need to set eve-ng according to the subnet you want.