Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
rohittarang
New Contributor II

Fortigate GUI not opening

Hi all,

I have created a topology in the EVE-NG software where my FortiGate firewall is connected to a switch, and the switch is connected to the management cloud. Now I want to open my FortiGate firewall GUI in Chrome browser, but it’s not opening.

FortiGate port 5: 192.168.100.16

Gateway: 192.168.100.1

(If I remove the static IP from port 5 and set it to DHCP, I can open the FortiGate GUI via the DHCP IP in Chrome.)

Please help me.

1 Solution
ozkanaltas
Valued Contributor II

Hi @rohittarang,

 

If you choose bridge instead of vmnet8 on the vmware side, you can give Fortigate the IP address from block 192.168.1.0/24.


https://docs.vmware.com/en/VMware-Workstation-Player-for-Windows/17.0/com.vmware.player.win.using.do...

 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW

View solution in original post

If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
15 REPLIES 15
ozkanaltas
Valued Contributor II

Hi @rohittarang ,

 

Did you configure static route on Fortigate? 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
rohittarang

Yes. I have configured Static route.

FW1 # get route info routing-table static
Routing table for VRF=0
S* 0.0.0.0/0 [10/0] via 192.168.100.1, port5, [1/0]

ozkanaltas
Valued Contributor II

Hello @rohittarang ,

 

I think this issue related to Eve-ng environment. What happens if you manually give the IP address given by dhcp? Have you tried this before?

Also, can you run this sniffer command while trying access to GUI.

 

diagnose sniffer packet port5  

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
rohittarang

If I set port5 as dhcp and use that dhcp ip, then it's working. I can open gui via that dhcp ip. Received below reply by using sniffer command.

 

FW1 # diagnose sniffer packet port5
Using Original Sniffing Mode
interfaces=[port5]
filters=[none]
1.300988 arp who-has 192.168.100.1 tell 192.168.100.16
2.296860 arp who-has 192.168.100.1 tell 192.168.100.16
3.299165 arp who-has 192.168.100.1 tell 192.168.100.16
6.299592 arp who-has 192.168.100.1 tell 192.168.100.16
7.297451 arp who-has 192.168.100.1 tell 192.168.100.16
8.297475 arp who-has 192.168.100.1 tell 192.168.100.16
11.303673 arp who-has 192.168.100.1 tell 192.168.100.16
12.296704 arp who-has 192.168.100.1 tell 192.168.100.16
13.296837 arp who-has 192.168.100.1 tell 192.168.100.16
16.304994 arp who-has 192.168.100.1 tell 192.168.100.16
17.297083 arp who-has 192.168.100.1 tell 192.168.100.16

ozkanaltas
Valued Contributor II

Hi @rohittarang ,

 

What I actually mean is this, for example, when you configure dhcp, dhcp gives you the IP address 192.168.100.50. Does anything change when you manually enter this address into port5?

 

However, it is interesting that EVE-NG does not respond to arp requests.

 

Also, can you put Fortigate into dhcp mode and check the gateway address coming from dhcp? Maybe EVE-NG is using the address 192.168.100.2.

 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
rohittarang

Its opening via DHCP IP

 

FW1 # show system interface
name Name.
fortilink static 0.0.0.0 0.0.0.0 10.255.1.1 255.255.255.0 up disable aggregate enable
l2t.root static 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 up disable tunnel enable
naf.root static 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 up disable tunnel disable
port1 static 0.0.0.0 0.0.0.0 192.168.1.102 255.255.255.0 up disable physical enable
port2 static 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 up disable physical enable
port3 static 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 up disable physical enable
port4 static 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 up disable physical enable
port5 dhcp 0.0.0.0 0.0.0.0 192.168.198.130 255.255.255.0 up disable physical enable

ozkanaltas
Valued Contributor II

Hi @rohittarang ,

 

Can you check the gateway IP address on GUI while port5 is configured with dhcp? You can check the gateway address on Network -> Interfaces -> Port5. 

 

get router info routing-table database

get router info routing-table all

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
rohittarang

FW1 # get router info routing-table database
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
V - BGP VPNv4
> - selected route, * - FIB route, p - stale info

Routing table for VRF=0
S *> 0.0.0.0/0 [5/0] via 192.168.198.2, port5, [1/0]
S 0.0.0.0/0 [10/0] via 192.168.100.1, port5, [1/0]
C *> 192.168.1.0/24 is directly connected, port1
C *> 192.168.198.0/24 is directly connected, port5


FW1 # get router info routing-table all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
V - BGP VPNv4
* - candidate default

Routing table for VRF=0
S* 0.0.0.0/0 [5/0] via 192.168.198.2, port5, [1/0]
C 192.168.1.0/24 is directly connected, port1
C 192.168.198.0/24 is directly connected, port5

 

ozkanaltas
Valued Contributor II

Hi @rohittarang ,

 

I think the 192.168.100.0/24 network is not configured in eve-ng, so when you try to configure FortiGate in this way, eve-ng does not respond to arp requests.

 

As you can see, eve-ng distributes IP addresses from the 192.168.198.0/24 subnet. That's why you need to give an IP address from the 192.168.198.0/24 subnet and enter 192.168.198.2 as the static route.

 

port5 dhcp 0.0.0.0 0.0.0.0 192.168.198.130 255.255.255.0 up disable physical enable

 

S *> 0.0.0.0/0 [5/0] via 192.168.198.2, port5, [1/0]

 

 

Or you need to set eve-ng according to the subnet you want.

 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors