Help
Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Erich_von_MaurnbÃ_ck
New Contributor

Created on ‎05-16-2014 02:22 AM

LAN cannot reach WLAN and backwards

Hello, I have a question related to routing, network, dns, policy, firewall... As I am not an expert I actually can' t find a solution for my problem. I have FortiWiFi 40C, latest Firmware v4.0, builid3608 (GA Patch 7) IPV6 off My Interfaces WAN: 192.168.0.12 Internal (LAN): 192.168.1.x, DHCP enabled from 192.168.1.101, DNS - 192.168.1.50 (internal W2012R2 Server) WLAN: 10.10.30.x, DHCP enabled from 10.10.30.101, DNS - 192.168.1.50 (internal W2012R2 Server) My Policies: 1. WAN -> Internet connection, ok 2. LAN -> WAN (NAT) =Internet working -> WLAN (no NAT), Source/Destination all/all, do not see WLAN Clients, can Ping Fortinet (10.10.30.1) but CANNOT ping the WLAN Clients 3. WLAN -> WAN (NAT) =Internet working -> LAN (no NAT), Source/Destination all/all, do not see LAN Clients, CAN ping them all! 4. any/any - deny DNS -> FortiGuard Servers So the main problem is, that I cannot reach my domain server, so I cannot join the domain. So any idea is great, where I can start the search to solve the problem! Best regards, Erich
3445
0 Kudos
4 REPLIES 4
rwpatterson
Valued Contributor III

Created on ‎05-16-2014 03:15 AM

Welcome to the forums. From what you posted, you are trying to reach from the WLAN and LAN ports to ' all' on ' any' interface. Avoid such sloppy programming. You want to reach the WLAN from the LAN, make a policy that does just that. Using ' any' as a target for a policy is very sloppy and difficult to troubleshoot. My two cents.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
1496
0 Kudos
Erich_von_MaurnbÃ_ck
New Contributor

Created on ‎05-16-2014 10:14 AM

Hello, thank you for your proposal. You are right, that is no good programming - I changed this. But the problem is already there.
1496
0 Kudos
jtfinley
Contributor
In response to Erich_von_MaurnbÃ_ck

Created on ‎05-29-2014 10:39 AM

Should be rather straight forward: Define your network variables LAN: 192.168.1.0/24 WLAN: 10.10.30.0/24 Create (2) FW Policies; DO NOT USE NAT INTERNAL:LAN:ALL -> WIFI:WLAN:ALL WIFI:WLAN:ALL -> INTERNAL:LAN:ALL As long as devices on each subnet is using the Fortigate as the DF Gateway, it should work.
1496
0 Kudos
emnoc
Esteemed Contributor III

Created on ‎05-30-2014 05:43 PM

And to add to already good information; diag debug flow is your best friend. 99% of the problems can easily be identified by execution of a diagnostics

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
1496
0 Kudos
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors
View all
Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Social Media
Security Research
Company
News & Articles
Contact Us

Copyright 2024 Fortinet, Inc. All Rights Reserved.