Fortigate VM can not ping the device after the reboot

[piaakit1210]

Dear All, 

            Would like to seek for your help, every time when i try reboot the fortigate VM, and it doesnt reach the VM fortigate IP, its can not ping, any idea ?

port1 as lan with IP 192.168.12.99 

port2 as wan 

Keith

[AEK]

Hello Keith

Do you mean FG VM is not pingable after each reboot? Do you still have https/ssh access to it after reboot? Can you provide more details?

[piaakit1210]

Yes and I have https and ssh enabled on port 1, what others info you do need ? And I revert the snapshot in other to reach it back 

[AEK]

Do you have ani local-in policy?

show firewall local-in-policy

Can you also share port1 config?

Also when the issue occurs, try enter the VM via ssh, https or console from hypervisor and try ping your internal hosts from the VM, and try check if any relevant logs in system logs.

[piaakit1210]

no i didn't turn on any local-in policy, i remember i have similar issue when i first setup this FG VM, as i first added 2 NIC in esxi, first NIC is WAN and 2nd NIC is LAN, and even i assigned IP on port2,  i can not reach the FG VM, i need to remove the WAN NIC in esxi and assign port1 with LAN IP, then i could reach the FG VM, after i added WAN NIC back in esxi, also pleaes find below result for port1 config n local in policy 

FGVMEVENRDPC6I86 # show firewall local-in-policy
config firewall local-in-policy
end

FGVMEVENRDPC6I86 (port1) # show
config system interface
edit "port1"
set vdom "root"
set ip 192.168.12.99 255.255.255.0
set allowaccess ping https ssh http fgfm
set type physical
set device-identification enable
set snmp-index 1
next
end

[AEK]

Can you share also port2 config and routing config.

show router static

[piaakit1210]

There you go 

FGVMEVENRDPC6I86 (port2) # show
config system interface
edit "port2"
set vdom "root"
set mode pppoe
set allowaccess ping https
set type physical
set alias "Internet"
set lldp-reception enable
set role wan
set snmp-index 2
set username "60008689561@zs.gcable"
set password ENC mbuftR8pfAuDawV4RhElFmQcDKWz3xJzidtcsnJwbUpQSCIwRodkcEml2vkst6/ofsqzmOWqdJ8KezP/LTw7JEOPn/q096/c93G+97SmUdI6NzEKmzrUIMAuF1PdaaeVTuM//7XovL1jz4fZ8110EtWzjFhsjYUm4MaYw1Yn5680EX/mVzO4e1dLROifX+HgaCXQQQ==
next
end

FGVMEVENRDPC6I86 # show router static
config router static
edit 1
set dst 161.81.xx.xxx 255.255.255.255
set distance 5
set device "port2"
set dynamic-gateway enable
next
edit 2
set dst 0.0.0.0 128.0.0.0
set gateway 192.168.12.90
set device "port1"
next
edit 3
set dst 128.0.0.0 128.0.0.0
set gateway 192.168.12.90
set device "port1"
next
end

Keith

[AEK]

I suspect a routing problem.

Please run the below two commands before the issue occurs and run them once the issue occurs. If you can't access FG to run the command please run it from ESXi console.

get system interface
get router info routing-table all

After that, during the access issue, try do the following:

- Access the FG console (if not accessible then use ESXi console)

- Run the below commands on FG CLI

diag sniffer packet any "host <CLIENT-IP> and icmp" 4

- Then start pinging FG from your client host

- Then share the output

[piaakit1210]

there you go with the system interface and routing table result first, as where the FG VM located is at my other home in china, i setup a esxi there with openvpn client acting as gateway there to form a site to site vpn between my home at HK, and other home at China, i will not be able to reboot if i go to there again, i'm afraid after the rebooted, the issue occur, i can not reach the network there 

FGVMEVENRDPC6I86 # get system interface
== [ port1 ]
name: port1 mode: static ip: 192.168.12.99 255.255.255.0 status: up ne tbios-forward: disable type: physical ring-rx: 0 ring-tx: 0 netflow-sam pler: disable sflow-sampler: disable src-check: enable explicit-web-pro xy: disable explicit-ftp-proxy: disable proxy-captive-portal: disable w ccp: disable drop-overlapped-fragment: disable drop-fragment: disable m tu-override: disable
== [ naf.root ]
name: naf.root ip: 0.0.0.0 0.0.0.0 status: up netbios-forward: disable type: tunnel netflow-sampler: disable sflow-sampler: disable src-check: disable explicit-web-proxy: disable explicit-ftp-proxy: disable proxy- captive-portal: disable wccp: disable
== [ l2t.root ]
name: l2t.root ip: 0.0.0.0 0.0.0.0 status: up netbios-forward: disable type: tunnel netflow-sampler: disable sflow-sampler: disable src-check: enable explicit-web-proxy: disable explicit-ftp-proxy: disable proxy-c aptive-portal: disable wccp: disable
== [ ssl.root ]
name: ssl.root ip: 0.0.0.0 0.0.0.0 status: up netbios-forward: disable type: tunnel netflow-sampler: disable sflow-sampler: disable src-check: enable explicit-web-proxy: disable explicit-ftp-proxy: disable proxy-c aptive-portal: disable wccp: disable
== [ fortilink ]
name: fortilink mode: static ip: 10.255.1.1 255.255.255.0 status: up n etbios-forward: disable type: aggregate netflow-sampler: disable sflow-s ampler: disable src-check: enable explicit-web-proxy: disable explicit- ftp-proxy: disable proxy-captive-portal: disable wccp: disable drop-ove rlapped-fragment: disable drop-fragment: disable mtu-override: disable
== [ port2 ]
name: port2 mode: pppoe ip: 10.95.213.195 255.255.255.255 status: up n etbios-forward: disable type: physical ring-rx: 0 ring-tx: 0 netflow-sa mpler: disable sflow-sampler: disable src-check: enable explicit-web-pr oxy: disable explicit-ftp-proxy: disable proxy-captive-portal: disable wccp: disable drop-overlapped-fragment: disable drop-fragment: disable mtu-override: disable

FGVMEVENRDPC6I86 # get router info routing-table all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
V - BGP VPNv4
* - candidate default

Routing table for VRF=0
S* 0.0.0.0/0 [5/0] via 10.95.223.254, ppp1, [1/0]
S 0.0.0.0/1 [10/0] via 192.168.12.90, port1, [1/0]
C 10.95.xxx.xxx/32 is directly connected, ppp1
C 10.95.xxx.xxx/32 is directly connected, ppp1
S 128.0.0.0/1 [10/0] via 192.168.12.90, port1, [1/0]
S 161.81.xx.xxx/32 [5/0] via 10.95.223.254, ppp1, [1/0]
C 192.168.12.0/24 is directly connected, port1

Keith