IP Pools and firewall traffic

[rwpatterson]

Just finished pulling my hair out for 3 hours trying to solve a problem. Let me explain: I have an internal subnet 172.18.2.0/24. They never needed the Internet before 2 days ago, so I really didn' t look to see if they worked or not. Well it turns out that the IPSec tunnel I tried to get working didn' t work. We couldn' t work out why, so we scrapped that in favor of their SSL VPN client/server solution hosted on a workstation/server here. Well they set it up, installed, and failed to get that working as well. I started by pinging to their peer. It didn' t come back. I ran the sniffer from the firewall on the inside port: failure. I sniffed the outside port: success! The firewall was not sending the packets back in! What the hell? I sent a PING from the firewall and got replies. The strange thing was that the PING replies were in 0 ms. This network ain' t a Ferrari! That' s not right! I run a trace route. First hop it ends.... The FGT is intercepting the traffic. I looked everywhere until I saw an IP pool that covered the entire 172.18.2.0/24 subnet. I broke it down to the 2 single hosts that needed coverage. After that, everything started working as desired. An after thought...maybe this was the same reason the IPSec tunnel didn' t work right? Similar symptoms. I could PING out to them, but they couldn' t get in to the host here. Just an FYI if you' re experiencing weirdness that you can' t explain away.

[emnoc]

So what src where map to use that pool ? I seen weird things with ippool but most has always been explain and either dealt with a layer8 Problem ( me ) or fwpolicies ordering.

[ede_pfau]

Some other member just has had this issue a couple of days ago - http://support.fortinet.com/forum/tm.asp?m=97375 The behavior you' ve described is explained (kind of) in the FortiOS Handbook (pg. 198-199 in the 4.3 version).

If a FortiGate interface IP address overlaps with one or more IP pool address ranges, the interface responds to ARP requests for all of the IP addresses in the overlapping IP pools.

What Fortinet doesn' t mention explicitly is that the mere existance of an IP pool is sufficient, not it' s use in a policy.

[emnoc]

That' s interesting, so are we trying to duplicate ippools in one of the same local lan address space? If a FGT had numerous LANs is it going to handle Arp request for that pool across any LAN interface?

[rwpatterson]

I looked into the routing table and didn' t see any routes for that traffic aside from my static. That' s where I assumed (wrongly) that the traffic should have flowed through the unit. I ran across this years ago, but totally forgot about it...

[rwpatterson]

ORIGINAL: emnoc That' s interesting, so are we trying to duplicate ippools in one of the same local lan address space? If a FGT had numerous LANs is it going to handle Arp request for that pool across any LAN interface?

How my setup worked: The target LAN was remote to the FGT. The outbound traffic went out without issue, but the return traffic on that same policy was intercepted by the IPpool.