IPv4 Policy Lan to Lan

[Yosef]

Hi

I have two lan interfaces the first 192.168.0.0/255.255.252.0 and the second 192.168.4.0/255.255.255.0 I want to connect the the devices on lan 192.168.4 to the server with an active directory and sharing folder on 192.168.0.1 i created two ipv4 policies to connect between the lans but i can't get ping between the lans what can be the problem ?

Tanks

[emnoc]

I can't pull up ALL the graphs but what I would do is to start a diag debug flow and monitor the output . The output will give you a clue and direction on what to check next.

e.g

diag debug disable

diag debug enable

diag debug flow filter addr 192.168.0.1

diag debug flow filter proto 1

diag debug flow show console enable

diag debug flow trace start 100

Then conduct a ping to the target and when your done doing your testing & diagnostics

diag debug reset

diag debug disable

Also I would review the fwpolicies between the interne1+3 interfaces/ netmask on the interfaces and hosts / fwpolicies ordering+sequence/ etc....

[ede_pfau]

Did I spot this right that the first LAN has a 255.255.252.0 mask? That is, 4 Class C networks covering 192.168.0.0 to 192.168.3.254?

Are you sure this is intended?

If your server is not responding then I would suspect a personal firewall (software) on the server blocking ICMP. Ping the interface IP addresses of the FGT instead. If that is working the policies are OK but the hosts are not responding.

[Fahad]

i noticed that you enabled NAT in the policy is it required since it lan-to-lan ? disable it and give a try.

[Yosef]

Where could I see the results of the debug result?

[Yosef]

server 1 192.168.0.1 is an active directory server with subnet 255.255.252.0 

server 1 connected to internal 1 :

internal 1 connected to internal 3 through these policies :

internal 3 is a DHCP server to another lan network :

I want to get ping reply from the server to computer on internal 3

[Dave_Hall]

Even with screen shots, the network topology is confusing is hell. lol.

In firewall policy (internal3->internal1) you are only allowing certain port traffic through, though not the ports needed for actually file/folder access (aka file/print sharing).  In the other firewall policy (internal1->internal3), you are basically only giving "01servers" RDP access.  The DHCP server on internal3 is configured to hand out 192.168.4.61 (which is not the Fortigate IP from what I can tell) as the gateway IP address -- is that correct?

As others have indicated, NAT should be disabled.  Since an Active Directory is involve, there should be some sort of trust relationship between the two subnets.  If the computers on internal3 are not part of the same AD domain than those computers (on internal3) really shouldn't be connecting directly to the AD computer.  (i.e. Not best practise).

edit: if you want internal3 to "join" the same AD domain, there are several websites showing how to do this.

[Fahad]

hi,

why you enabled nat ? do you require translation ? if not disabled and should work.