IP addresses stop working on WAN Interface

[Mirek_Gruber]

Hello, I have serious problem at one of my FortiGate-60D v5.0,build0208,130603 (GA Patch 3) Firewall. I have a 7 public IP addresses x.x.x.2-7 on WAN interface. Once or twice per day one of them completely stop working. No ping, no services on it. When I do reboot, everything is going fine. It is very strange. Does anyone know, where could be the problem? Thank you very much.

[GusTech]

Welcome to the forum! Do you use VIP and have you redirected all the ports?

[Mirek_Gruber]

Please, look at picture.

[AtiT]

Hi Mirek, Do you have a standalone FortiGate or you are using it in a HA cluster? Do you have access to the router before the FortiGate to check the ARP table when the problem occurs?

[Mirek_Gruber]

Hi, thank you, for your response. It is a standalone Fortigate, no HA cluster. What you mean " before" the FortiGate? thank you.

[Richard_Bartlett]

I have a similar problem on build179 5.0 (patch2) [aka 5.0.2]. There is a similar forum thread talking of host-load-balancing being a similar issue with 5.0.3 where the fix was to regress back to 5.0.2. So unless the fix for this is in beta, we need to report this. In our situation the interfaces are grouped as zones. Then (of course) the VIP port forwards are performed on the actual zone member interfaces. diag sniff pack ' tcp and host <vip> and port <port>' 6 proved the packets were arriving (and not forwarded) diag debug en diag debug flow show console enable diag debug flow filter daddr <vip> diag debug flow filter dport <port> diag flow trace start 10 indicated that there was something in the ' iprope' that was failing. This isn' t necessarily the exact message I got (from memory and then a google to match what I think I remember!) : iprope_in_check() check failed Ours is a FortiWiFi 40C. It is pretty well the only firewall out of about 20 on our network that is running FortiOS 5. Consequently we' re losing some amount of confidence in 5.0 but we' re not having this problem as often as you. Our fix isn' t to reboot, but simply to go in via CLI config firewall vip edit <usually an index that is suffering the problem is put in here> set arp-reply disable next end If we have the issue again, we toggle arp-reply to enable and back to disable (the GUI default is enable but this seems daft when the IP is also an interface on this same unit then that IP element is clearly going to respond to ARP whatever the setting in this port-forward is set to).

[Mirek_Gruber]

Hello everyone, I think I have solved it. It was pretty simple. We had WAN2 port connected to the same ethernet as WAN1 (by mistake). It was configured as DHCP client and no DHCP server on that ethernet. We are not using WAN2 to anything, so I disabled port and immediately IP address is working. It is strange, that only 3 IP addresses from 7 was affected by this. Thank you for yours support. Mirek

[rwpatterson]

I' ll bet the 3 that were affected were even IP addresses (in the last octet). Fortigate load balancing.

[Mirek_Gruber]

No.. 3,4,6