Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Mirek_Gruber
New Contributor

IP addresses stop working on WAN Interface

Hello, I have serious problem at one of my FortiGate-60D v5.0,build0208,130603 (GA Patch 3) Firewall. I have a 7 public IP addresses x.x.x.2-7 on WAN interface. Once or twice per day one of them completely stop working. No ping, no services on it. When I do reboot, everything is going fine. It is very strange. Does anyone know, where could be the problem? Thank you very much.
8 REPLIES 8
GusTech
Contributor II

Welcome to the forum! Do you use VIP and have you redirected all the ports?

Fortigate <3

Fortigate <3
Mirek_Gruber

Please, look at picture.
AtiT
Valued Contributor

Hi Mirek, Do you have a standalone FortiGate or you are using it in a HA cluster? Do you have access to the router before the FortiGate to check the ARP table when the problem occurs?

AtiT

AtiT
Mirek_Gruber

Hi, thank you, for your response. It is a standalone Fortigate, no HA cluster. What you mean " before" the FortiGate? thank you.
Richard_Bartlett
New Contributor

I have a similar problem on build179 5.0 (patch2) [aka 5.0.2]. There is a similar forum thread talking of host-load-balancing being a similar issue with 5.0.3 where the fix was to regress back to 5.0.2. So unless the fix for this is in beta, we need to report this. In our situation the interfaces are grouped as zones. Then (of course) the VIP port forwards are performed on the actual zone member interfaces. diag sniff pack ' tcp and host <vip> and port <port>' 6 proved the packets were arriving (and not forwarded) diag debug en diag debug flow show console enable diag debug flow filter daddr <vip> diag debug flow filter dport <port> diag flow trace start 10 indicated that there was something in the ' iprope' that was failing. This isn' t necessarily the exact message I got (from memory and then a google to match what I think I remember!) : iprope_in_check() check failed Ours is a FortiWiFi 40C. It is pretty well the only firewall out of about 20 on our network that is running FortiOS 5. Consequently we' re losing some amount of confidence in 5.0 but we' re not having this problem as often as you. Our fix isn' t to reboot, but simply to go in via CLI config firewall vip edit <usually an index that is suffering the problem is put in here> set arp-reply disable next end If we have the issue again, we toggle arp-reply to enable and back to disable (the GUI default is enable but this seems daft when the IP is also an interface on this same unit then that IP element is clearly going to respond to ARP whatever the setting in this port-forward is set to).
Mirek_Gruber

Hello everyone, I think I have solved it. It was pretty simple. We had WAN2 port connected to the same ethernet as WAN1 (by mistake). It was configured as DHCP client and no DHCP server on that ethernet. We are not using WAN2 to anything, so I disabled port and immediately IP address is working. It is strange, that only 3 IP addresses from 7 was affected by this. Thank you for yours support. Mirek
rwpatterson
Valued Contributor III

I' ll bet the 3 that were affected were even IP addresses (in the last octet). Fortigate load balancing.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
Mirek_Gruber

No.. 3,4,6
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors