Internal users cannot ping secondary WAN-address

[Michel_Schuurman]

Looking over things I guess...

Situation:

WAN1 (primary address): Static IP

WAN1 (secondary address): Static IP

WAN2 (primary address): Dynamic IP

From the internet I am able to ping all three IP-addresses. However, internal users cannot.

They can ping both primary addresses but not the WAN1-secondary address.

Obiously ping is enabled in all three cases. 

Since the WAN1-secondary address hosts an application which needs to be accessible from outside as well as inside and DNS resolves to the public IP address users are now not able to connect to this application. 

Does anyone have an idea what is wrong here?

[rwpatterson]

The reason I made the wan1-wan1 comment is that on my FWF80CM, the wan ports are GB, so I use them for my inside servers, and the dmz labeled port is my Internet.

[Dave_Hall]

If the application hosted at the secondary WAN1 IP has a internal private IP counter-part, you may want to look into DNS-translation.

[ede_pfau]

As per the log message there is a permission problem here. This might come from a missing policy (which I doubt) but also from a missing route.

Edit: you might have a look at this : http://kb.fortinet.com/kb/viewContent.do?externalId=FD31702 .

What does your routing table look like? I mean, the live one (Monitor).

And no, I just tested with a DMZ port, you don't need any policy to ping a FGT interface. The definition of the interface address automatically inserts a policy ("connected") which is sufficient.

As Bob has posted correctly this doesn't apply to traffic from host to host.

BTW, any Trusted Hosts?

[emnoc]

id=13 trace_id=9610 msg="vd-root received a packet(proto=1, X.X.X.X:3->Y.Y.Y.Y.Y:8) from IntUsers." id=13 trace_id=9610 msg="allocate a new session-042326d9" id=13 trace_id=9610 msg="iprope_in_check() check failed, drop"  [/QUOTE

Iprope_in_check is probably due to  uRPF checks.

You have some things to check;

1: A firewall policy ( nat )

2: set allowaccess icmp ( under your secondary ) is on since you say you can ping it from the external network ( so skip that for now  )3:  and the set trusthost if used needs to match x.x.x.x  for your user.

 and finally,

 Do you have any thing weird with IntUsers  like a static route on the   Fortigate that overlaps the   secondary?

[Nihas]

Will the below option work out?

[ul]

First create an internet policy for local users ( using the primary IP as NAT).

Create hair pin policy  with source IP as Primary IP / int as WAN1 - and destination as Secondary IP ./int as WAN1 - select ICMP as service) [/ul]

So the local users will be able to ping the second IP like the below. ( I think :p )

192.168.0.0 ( Local users ) -- >2.2.2.2 ( Secondary IP)

192.168.0.0 ( Local users ) -- >NATED 1.1.1.1  ( Primary IP)-- >2.2.2.2 ( Secondary IP)

Best 

Nihas