Inferface is up still cant ping from outside

[Vatsal_shah]

I'm currently setting up a FortiGate firewall and facing a strange issue. The FortiGate WAN interface is directly connected to my ISP router. 

From the FortiGate, I can ping the ISP gateway successfully.
However, from the ISP router side (or any host behind it), I cannot ping the FortiGate IP.

Here’s what I’ve checked so far:

• Ping is enabled on the WAN interface (set allowaccess ping is configured).

• The interface is up, IP is correctly assigned, and the cable is physically connected.

• No local-in policy is blocking ICMP.

• No trusted hosts are configured under the admin settings.

• Subnet and default routes appear correct.

and when I connect that ips wire to my laptop it can get the internet access and able to ping my ip from outside network.

[funkylicious]

i see that you have 2 public ip/wan interfaces.

if you didnt configure sdwan or ecmp/asymmetric routing, then that might be the issue.

[Vatsal_shah]

I have done sd wan

[funkylicious]

its time for some sniffer or debug captures while trying to ping the interface/ip and lets see what really happens to the packets.

[Vatsal_shah]

I tried using this command diagnose sniffer packet any "icmp and host 182.75.142.114" 4
and got this output:

AHM_MANINAGAR_MNG # diagnose sniffer packet a "icmp and host 182.75.142.114" 4
interfaces=[a]
filters=[icmp and host 182.75.142.114]
0.259517 a -- 103.240.162.91 -> 182.75.142.114: icmp: echo request
0.356577 a -- 49.43.25.137 -> 182.75.142.114: icmp: echo request
3.258478 a -- 103.240.162.91 -> 182.75.142.114: icmp: echo request
5.198390 a -- 49.43.25.137 -> 182.75.142.114: icmp: echo request
6.242370 a -- 103.240.162.91 -> 182.75.142.114: icmp: echo request
9.247340 a -- 103.240.162.91 -> 182.75.142.114: icmp: echo request
10.184206 a -- 49.43.25.137 -> 182.75.142.114: icmp: echo request
12.261584 a -- 103.240.162.91 -> 182.75.142.114: icmp: echo request
15.180265 a -- 49.43.25.137 -> 182.75.142.114: icmp: echo request
15.297683 a -- 103.240.162.91 -> 182.75.142.114: icmp: echo request
18.317582 a -- 103.240.162.91 -> 182.75.142.114: icmp: echo request
21.315861 a -- 103.240.162.91 -> 182.75.142.114: icmp: echo request
^C
13 packets received by filter
0 packets dropped by kernel

[HarryTran]

May I know what the OS version running on the box?

[Vatsal_shah]

7.2.11

[sjoshi]

Hi,

Have you tried connecting a laptop directly on the fortigate wan port and see if that works.

Is arp entry coming correctly?

Try to ping again from the ISP end towards FGT IP and take a pcap to see if the traffic is reaching the FGT

diag sniff packet any 'host x.x.x.x' 4 0 l >> where x.x.x.x is the FGT IP

[Vatsal_shah]

I tried directly connecting my laptop to firewall A port and then i check my laptop ipconfig I got all my ip and gateway proper and try to ping with different laptop and pc from that local subnet I can ping  that IP and gateway to of that ISP but when I plug back the cable to firewall I can ping only to gateway, but can't ping interface ip.

[sjoshi]

I guess taking packet capture will give clarity.

Along you capture take a debug flow

https://docs.fortinet.com/document/fortigate/7.6.3/administration-guide/54688/debugging-the-packet-f...

Take this output while pinging FGT IP