Fortigate wan ip address is open for ping

[Johnnyb1984]

We have 2 Fortigate 200F firewalls in HA.

The WAN interface is responding to ping from any ip address.

We want to be able to ping this ip from certain locations only so we added these ip addresses to trusted hosts section under administrators. 

When I run the following debug I can see the traffic coming in but there is no access rule specified.

local ip replaced with: 2.2.2.2
fortigate wan ip replaced with: 3.3.3.3

diagnose debug enable
diagnose debug flow filter addr 2.2.2.2
diagnose debug flow show function-name enable
diagnose debug flow trace start 100

id=20085 trace_id=246 func=print_pkt_detail line=5871 msg="vd-root:0 received a packet(proto=1, 2.2.2.2:1->3.3.3.3:2048) tun_id=0.0.0.0 from port1. type=8, code=0, id=1, seq=35."
id=20085 trace_id=246 func=init_ip_session_common line=6050 msg="allocate a new session-0275cc51, tun_id=0.0.0.0"
id=20085 trace_id=246 func=vf_ip_route_input_common line=2605 msg="find a route: flag=80000000 gw-3.3.3.3 via root"
id=20085 trace_id=247 func=print_pkt_detail line=5871 msg="vd-root:0 received a packet(proto=1, 3.3.3.3:1->2.2.2.2:0) tun_id=0.0.0.0 from local. type=0, code=0, id=1, seq=35."
id=20085 trace_id=247 func=resolve_ip_tuple_fast line=5957 msg="Find an existing session, id-0275cc51, reply direction"
id=20085 trace_id=248 func=print_pkt_detail line=5871 msg="vd-root:0 received a packet(proto=1, 2.2.2.2:1->3.3.3.3:2048) tun_id=0.0.0.0 from port1. type=8, code=0, id=1, seq=36."
id=20085 trace_id=248 func=resolve_ip_tuple_fast line=5957 msg="Find an existing session, id-0275cc51, original direction"
id=20085 trace_id=249 func=print_pkt_detail line=5871 msg="vd-root:0 received a packet(proto=1, 3.3.3.3:1->2.2.2.2:0) tun_id=0.0.0.0 from local. type=0, code=0, id=1, seq=36."
id=20085 trace_id=249 func=resolve_ip_tuple_fast line=5957 msg="Find an existing session, id-0275cc51, reply direction"
id=20085 trace_id=250 func=print_pkt_detail line=5871 msg="vd-root:0 received a packet(proto=1, 2.2.2.2:1->3.3.3.3:2048) tun_id=0.0.0.0 from port1. type=8, code=0, id=1, seq=37."
id=20085 trace_id=250 func=resolve_ip_tuple_fast line=5957 msg="Find an existing session, id-0275cc51, original direction"
id=20085 trace_id=251 func=print_pkt_detail line=5871 msg="vd-root:0 received a packet(proto=1, 3.3.3.3:1->2.2.2.2:0) tun_id=0.0.0.0 from local. type=0, code=0, id=1, seq=37."
id=20085 trace_id=251 func=resolve_ip_tuple_fast line=5957 msg="Find an existing session, id-0275cc51, reply direction"
id=20085 trace_id=252 func=print_pkt_detail line=5871 msg="vd-root:0 received a packet(proto=1, 2.2.2.2:1->3.3.3.3:2048) tun_id=0.0.0.0 from port1. type=8, code=0, id=1, seq=38."
id=20085 trace_id=252 func=resolve_ip_tuple_fast line=5957 msg="Find an existing session, id-0275cc51, original direction"
id=20085 trace_id=253 func=print_pkt_detail line=5871 msg="vd-root:0 received a packet(proto=1, 3.3.3.3:1->2.2.2.2:0) tun_id=0.0.0.0 from local. type=0, code=0, id=1, seq=38."
id=20085 trace_id=253 func=resolve_ip_tuple_fast line=5957 msg="Find an existing session, id-0275cc51, reply direction"

[akristof]

Hello,

If you have ping enabled on wan1 interface and at least one admin without trusted hosts, ping will be working from internet (FortiGate will reply). So you need to have trustedhosts on all admin accounts. Or you can create local-in-policy with src-list of allowed IPs and block every other source:

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/363127/local-in-policies

[Johnnyb1984]

Hi Adrian,

Thanks for the reply.

We don't have any admin profiles without trusted hosts. The local-in-policy is also not configured.

config system admin
edit "xxxxxxxx"
set trusthost1 x.x.x.x 255.255.255.255
set trusthost2 x.x.x.x 255.255.255.255
set trusthost3 x.x.x.x 255.255.255.255
set trusthost4 x.x.x.x 255.255.255.255
set trusthost5 x.x.x.x 255.255.255.255
set trusthost6 x.x.x.x 255.255.255.0
set trusthost7 x.x.x.x 255.255.255.0
set trusthost8 x.x.x.x 255.255.255.0
set trusthost9 x.x.x.x 255.0.0.0
set trusthost10 x.x.x.x 255.255.255.255
set accprofile "super_admin"
set vdom "root"
set password ENC
next
edit "xxxxxxxx"
set trusthost1 x.x.x.x 255.255.255.0
set accprofile "super_admin"
set vdom "root"
set password ENC
next
edit "xxxxxxxx"
set trusthost1 x.x.x.x 255.255.255.0
set accprofile "super_admin"
set vdom "root"
set password ENC
next
edit "xxxxxxxx"
set trusthost1 x.x.x.x 255.255.255.255
set accprofile "admin_no_access"
set vdom "root"
set password ENC
next
end

show
config firewall local-in-policy
end

Regards,

John

[akristof]

Hi,

Are you sure that the source IP does not match any subnet specified in trusthosts?

[Johnnyb1984]

Yes, I also get the same result when I test from multiple locations with www.locaping.com