Guest Internet Access

[anthony_2_oreilly]

Hello,

I have a Guest SSID that is in tunnel mode. I have a /24 DHCP scope and the IP of the Guest SSID is the 192.168.10.1. The default gateway is the same as the interface IP and I have a DNS of 8.8.8.8

The WAN 1 interface gets an DHCP IP Address of the ISP 192.168.100.10. The role of this interface is WAN.

I have a firewall policy of Incoming Interface is "Guest SSID" and the Outgoing Interface is "WAN1". Source, Destination, Service is "ALL". It is flow-based from inspection mode. NAT is enabled with IP Pool configuration of "Use Outgoing Interface Address" The policy is enabled and logs "All Sessions"

I have a static route of 0.0.0.0/0 to 192.168.100.1

When I connect to Guest, I get an IP address in the DHCP scope provided by the Guest SSID. I however do I get internet access. In the Forward Traffic logs I see some successful DHS requests e.g. 8.8.8.8. I am expecting more that I see in the logs. On the laptop connected to Guest, I cannot ping 8.8.8.8 or any other internet IP.

The Fortigate get the WAN IP 65.65.65.65 and I can upgrade the switches, ping 8.8.8.8 and ping www.amazon.co.uk successfully.

I don't know what I can try next? Anyone got any ideas?

Thanks

Anthony.

[AEK]

Hi Anthony

Do you see any blocked legitimate traffic?

Try enable all logs on the implicite deny policy to make troubleshooting easier.

Also I'd suggest to temporarily disable security profiles on the policy to see if they are not causing the issue.

[anthony_2_oreilly]

Hello,

Securtiy profiles are disabled. SSL "no-inspection". In the Forward logs I have some DNS, the odd udp traffic, roughly 60B not even Kbs.

Enable logs on the explicit rule shows no info from the Guest SSID client.

I have 2 * FG90G, 2 248D core switches and % * 48 port POE switches.

[AEK]

Hi

In order to make sure the issue is (or is not) on FG, I'd suggest to connect your host directly to FG (not via Guest SSID) and redo the test.

[hbac]

Hi @anthony_2_oreilly,

When connected to the guest wifi, are you able to ping 192.168.100.1? Are you able to ping 8.8.8.8 from the FortiGate? When pinging 8.8.8.8 from the guest wifi, please run debug flow below:

di deb disable
di deb res
diagnose debug flow filter clear
di deb flow filter addr 8.8.8.8
di deb flow filter proto 1
diagnose debug flow show function-name enable
di deb flow show iprope en
diagnose debug console timestamp enable
diagnose debug flow trace start 500
diagnose debug enable

Regards,