Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Greggor25
New Contributor

MPLS Routing Fortinet with AT&T

I'm having some routing issues with an MPLS circuit that terminates on an interface to my Fortinet. 

MPLS Fortinet Interface IP:10.200.66.1

AT&T MPLS HSRP Router IP:10.200.67.2

I've added a static route for 198.105.206.0/24 to HSRP 10.200.67.1.  I've created a security policy for my internal/trusted zone to MPLS to allow everything. I can't ping anything on the other end but the LAN. 

I don't maintain the AT&T Cisco router or any of the config.  I was told by the vendor to add their public blocks via static route and point to HSRP of the cisco router.  I'm at a loss here.

Here is traceroute that shows it makes it to AT&T MPLS router but nowhere else:

Tracing route to ts099.scl.five9.com [198.105.206.150] over a maximum of 30 hops:   1   1 ms   <1 ms   1 ms 10.200.32.1   2   <1 ms   2 ms   3 ms 192.168.53.1   3   <1 ms   <1 ms   <1 ms bedfordfortigate.daystartv.internal [10.200.106.1]   4   <1 ms   <1 ms   <1 ms 10.200.67.2   5   *       *       *   Request timed out.   6   *   ^C H:\>

2 Solutions
Toshi_Esumi
SuperUser
SuperUser

I don't have experiences with AT&T's MPLS. But if they were to asisgn a public subnet on the interface, the HSRP interface should have the public subnet (likely /29, or in addition to 10.200 IPs only to communicate between two Cisco routers). You should be able to call in their support and ask what you should configure on your FGT interface with what GW IP.

View solution in original post

rwpatterson
Valued Contributor III

I would run a Wireshark on the WAN port and see what traffic is hitting that interface.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

View solution in original post

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
6 REPLIES 6
Toshi_Esumi
SuperUser
SuperUser

I don't have experiences with AT&T's MPLS. But if they were to asisgn a public subnet on the interface, the HSRP interface should have the public subnet (likely /29, or in addition to 10.200 IPs only to communicate between two Cisco routers). You should be able to call in their support and ask what you should configure on your FGT interface with what GW IP.

Greggor25

I wasn't informed of a public subnet.  I was just told to connect the MPLS to my LAN and add the public routes of the other side via public block.  

Toshi_Esumi

If the public subnet is supposed to be configured "inside" interface, you must have ordered to get it from AT&T, then AT&T route that particular subnet from/to the internet to/from your MPLS circuit. If you didn't order it but they say they would provide a public subnet like a /30, that must be for "wan-side" interface to connect to thier MPLS router.

Either case, call their support. They would tell exactly what you need to do.

Greggor25

We're working with a VOIP softphone company that ordered the MPLS circuits.  I was told it was a platinum MPLS circuit.  Yesterday we did some troubleshooting where I bypassed the switch I was using and went straight to my firewall and I still can't get out. I hooked a laptop directly up to AT&T's MPLS router and still can't reach the other side.  The softphone people said something about NAT translation isn't working properly. 

rwpatterson
Valued Contributor III

I would run a Wireshark on the WAN port and see what traffic is hitting that interface.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
Greggor25

The problem has been identified.  AT&T had a problem with NAT translation and corrected the issue.  

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors