I created a IP network on Port 3 but can't ping the gateway from the clients

[IDMJohn]

I have a internal (default) network 10.25.0.0/24 on port 1 and 2. I created a new network 10.20.10.0/24 on port 3.  Clients connected to the internal network can ping the Fortigate gateway 10.25.0.1.  Clients connected to the network on Port 3 cannot ping the Fortigate gateway 10.25.10.1.  The clients can all access the internet no issues.  In Administrative Access area of the interface configuration for Port 3, I have HTTPS, SSH, PING and Security Fabric Connection checked.

Why can't my connected DHCP clients ping the gateway 10.25.10.1?  I can ping this address from CLI from within the firewall no issue (execute ping 10.25.10.1).  What am I missing?

Also how do I setup a one way route so that a connection to 10.25.10.X can be initiated from the 10.25.0.X network, but not vise versa?

Any help would be appreciated.

Thanks!

[dingjerry_FTNT · Accepted solution]

Hi @IDMJohn ,

You showed us several times with 10.20.x.x network, but I believe that all networks you are talking about are either 10.25.0.0/24 or 10.25.10.0/24.

It seems that you are careless.

So if you are the one who configured the FGT, you may need to double check all the configurations, such as interface settings, address objects (internal and internal3 address)for those networks, and so on.

Anyway:

1) The policy routes are useless if the routing table is correct.  I don't know what the purpose is for you to create those two policy routes.

2) You did not show us the internal3 configurations, so I don't know whether you enabled Ping for the Administrative settings or not;

3) You did not tell us where the IP 10.25.10.1 is.  Is it the internal3 IP?

4) If all configurations are correct, you may run the debug flow commands:

diag debug flow show iprope enable

diag debug flow filter proto 1

diag debug flow filter addr 10.25.10.1

diag debug flow trace start 20

diag debug enable

Then Ping 10.25.10.1 to reproduce the issue and collect the debug outputs.

NOTE:  Please DO NOT run continuous Ping.

5) "Also how do I setup a one way route so that a connection to 10.25.10.X can be initiated from the 10.25.0.X network, but not vise versa?"

So you are allowing traffic from internal to internal3 (aka Port3), but do not allow traffic from internal3 (aka Port3) to internal, right?

If so, just change the action of the firewall policy with the name "Port3 to internal" to Deny.

[dingjerry_FTNT · Accepted solution]

Hi @IDMJohn ,

Since you can Ping Internet IPs, I believe that you should see 10.25.10.1 if you run the following on your PC:

arp -a

If yes, I suspect that there is a device in the middle between FGT and your internal3 network blocking the ICMP traffic between internal networks.

[funkylicious]

do you have a firewall policy from internal to port3 ?

[IDMJohn]

I do.  This is a picture of it:

[funkylicious]

you have a policy from port3 to Internet, so no.

you want to acces from internal ( port1+2 ) the network on port3. you need to create one.

[IDMJohn]

I do, sorry.  See screen shots below:

and 

In addition, I have added the following Policy Routes:

and 

[IDMJohn]

DHCP clients connected to the 10.25.10.0 network cannot ping the gateway 10.25.10.1 or see/connect to any clients on the 10.20.0.0 network.  Clients on the 10.25.0.0 network cannot see/connect to clients on the 10.20.10.0 network.

[dingjerry_FTNT · Accepted solution]

Hi @IDMJohn ,

You showed us several times with 10.20.x.x network, but I believe that all networks you are talking about are either 10.25.0.0/24 or 10.25.10.0/24.

It seems that you are careless.

So if you are the one who configured the FGT, you may need to double check all the configurations, such as interface settings, address objects (internal and internal3 address)for those networks, and so on.

Anyway:

1) The policy routes are useless if the routing table is correct.  I don't know what the purpose is for you to create those two policy routes.

2) You did not show us the internal3 configurations, so I don't know whether you enabled Ping for the Administrative settings or not;

3) You did not tell us where the IP 10.25.10.1 is.  Is it the internal3 IP?

4) If all configurations are correct, you may run the debug flow commands:

diag debug flow show iprope enable

diag debug flow filter proto 1

diag debug flow filter addr 10.25.10.1

diag debug flow trace start 20

diag debug enable

Then Ping 10.25.10.1 to reproduce the issue and collect the debug outputs.

NOTE:  Please DO NOT run continuous Ping.

5) "Also how do I setup a one way route so that a connection to 10.25.10.X can be initiated from the 10.25.0.X network, but not vise versa?"

So you are allowing traffic from internal to internal3 (aka Port3), but do not allow traffic from internal3 (aka Port3) to internal, right?

If so, just change the action of the firewall policy with the name "Port3 to internal" to Deny.

[IDMJohn]

You are correct, I miss typed.  10.20 was a mistake.  I meant to type 10.25.  I created the policy routes in an attempt to try and get traffic to flow between the 2 networks  because it was not flowing after I created the security policies. To start with I was trying to get bi-directional connectivity.  When I am done, I want to restrict traffic from Port3 onto Internal.

[IDMJohn]

This is my Port3 configuration.  As you can see the port is configured as 10.25.10.1 and ping is enabled:

[IDMJohn]

When I run the diag debug commands and ping Port3 from the 10.25.10.0/24 network I get nothing.  I do the same commands on the Internal Port IP address 10.25.0.1 and I see the debug messages from the ping on the 10.25.0.0/24 network.  What does this tell me?