Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor II

LAN can not access server @ non-gateway DMZ(Fortigate 40F)

Hi All!


I have problem as title.

Follows illustration is current situation and work fine.Current.png

And unit test of addition network as follows illustration, (Reference: )

Ping/FTP access from Client( to FTP Server( @ FileZilla work fine.


Both merged as follows illustration..


And I added static route @ EdgeRouter 4 as follows

set protocols static route next-hop description 'Intranet to DMZ'
set protocols static route next-hop distance 253


Ping from Client ( to FTP Server( work fine.

PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=127 time=0.770 ms
64 bytes from icmp_seq=2 ttl=127 time=0.498 ms


But FTP won't work @ FileZilla as follows.

Status:   Connecting to
Status:   Connection established, waiting for welcome message...

Netstat @ FTP Server ( as follows.


Stall at SYN_RECEIVED state.


In this time. netstat result @ Client ( as follows

$ netstat -an|grep 10.1.0
tcp       0     0            ESTABLISHED

After several seconds, state changed as follows.

$ netstat -an|grep 10.1.0
tcp       0     1            FIN_WAIT1 


Result of traceroute @ Client ( as follows.

$ traceroute
traceroute to (, 30 hops max, 60 byte packets
 1 _gateway ( 0.252 ms 0.159 ms 0.155 ms
 2 ( 0.608 ms 0.559 ms 0.510 ms
 3 * * *
 4 * * *


And I had tried to packet capture @ Fortigate 40F, I saw SYN and SYN+ACK existence, look good?


I no idea why won't work, missing something.

Client sent packet to EdgeRouter4 but received  packet from Fortigate 40F is invalid I assume.

But I no idea how to route received packet from Fortigate 40F -> EdgeRouter4 -> Client


Please help me to fix.


Thanks all very much.

1 Solution

May be you can try adding the static route towards the FTP server on the linux as suggested in below discussion.



- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

View solution in original post


SYN -  Client-----SWITCH-----EDGE RTR------FGT----Server

SYN-ACK - Server-----FGT-----SWITCH-----Client  (Router won't get this packet as switch is aware about the source IP/MAC)
ACK - Client-----SWITCH-----EDGE RTR ------FGT------Server (Now the edge router is getting an ACK packet for a TCP handshake where there is no SYN-ACK). Can you check if the router is dropping this?



- Have you found a solution? Then give your helper a "Kudos" and mark the solution.


Thanks your reply quickly.


About SYN-ACK - Server-----FGT-----SWITCH-----Client
I had tried to add Static Route for return path (FGT --- EDGE RTR) as follows.

Screenshot from 2023-08-29 10-13-23.png

And firewall

Screenshot from 2023-08-29 10-16-17.png

Won't work still :p


About ACK, I will try to check.


Thanks a lot.


Static route on FGT won't help here , since the destination for SYN-ACK is in same subnet as FGT IP. FGT will use the directly connected route instead of Static.


As Toshi suggested, you can try adding a route on the client machine and check.

route add mask




- Have you found a solution? Then give your helper a "Kudos" and mark the solution.


Hi @srajeswaran 


I tried Toshi suggested and work.


Thanks you a lot.


I would rather try, to just test, adding a static route to the client machine for the DMZ subnet to because likely the problem is due to the fact the SYN hits the router first then forwarded to the FGT, while SYN-ACK tries to go directly to the client from the FGT, and I'm suspecting the FGT is dropping it.

Or, you could just sniff the traffic at the interface w/ to see what's coming in and what's going out (nor not going out).


<edit>Or, the switch might be learning the destination MAC from the router-forwarded SYN packet, and intercepting the ACK packet and redirecting to the FGT instead of sending to the router. The sniffing the interface would tell something.





Hi @Toshi_Esumi 


I tried to packet capture @ FGT LAN and result, as  your explain





SYN+ACK.jpgSYN+ACK tries to go directly to the client from the FGT.

SYN+ACK appear at LAN @ FGT, is FGT does not dropping it meant?


Thanks a lot,



I think so. You probably need to check how your switch is handing next by like setting up port mirroring if the switch doesn't support packet capture like above 2xx models of FortiSwitch. Also run Wireshark on the client machine side at the same time to see if the SYN-ACK is reaching and if it's responding with ACK.


In any case putting the FGT in the same subnet/broadcast domain with the GW device would cause some unexpected/unwanted L2 frame routing behavior like this. With your topology, I would set up a /30 interconnect subnet between the GW router and the FGT instead. 



New Contributor II

Hi All


I had tried more but did not work.

Therefore move FTP server to EDGE RTR


Thanks many help very much.



Hi Neko,

Can you check if the Edge router supports ICMP redirect and if so, can you enable it on LAN interface? I think this will be the ideal fix for your issue.

You can find more details on ICMP redirect on



- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

Top Kudoed Authors