No Internet | Azure FortiGate VM

[ozorio]

Hello fellow gurus. I am hoping one of you maybe able to help me with a problem I am facing.

I just deployed two Azure FortiGate VMs using the market place in a HA acive-passive with ELB/ILB.

I am able to get in to the management web interface. When I try to ping 8.8.8.8 from the cli 'exec ping 8.8.8.8' I am getting a 100% loss.

I check and I have the static route setup (which is created by default).

What else am I missing here? I'm new in Azure so it's probably something simple.

Thanks!

[mgoswami]

Hi,

May I know if you have used any source for the ping?

execute ping-options ?

This will show you if there are any filters set for the source.

If not, may I know if you have enabled VDOM?

BR,

Manosh

[YBKruthi]

Hi Ozorio,

I understand that you have created the FortiGate VM and tried to reach internet by initiating ping to 8.8.8.8

Please check below steps to narrow down the issue:

1. You need to ensure you have default route created towards the Internet facing interface.

2. Check if there is arp entry for the default gateway IP using "get system arp" or "diag ip arp list".

3. Only if arp entry is present, the ping initiated will be forwarded towards Egress interface and you can check on packet capture that the traffic is sent out or not.

If it is sent out and there is no ICMP reply packets, then this is not FortiGate concern. 

If there is no ICMP request shown in packet capture, then we can suspect that the issue is with traffic not being sent out of FortiGate VM.

Do let me know if you have any other queries/concerns.

Thanks,

Kruthi

[akushwaha]

Hi,

As I understand you're unable to ping 8.8.8.8 from FortiGate firewall. Please provide me the output of below commands to check further:

get router info routing-table details 8.8.8.8

diag sniffer packet any "host 8.8.8.8 and icmp" 4 0 a
<after runnin this command initiate ping traffic >

Best regards,

Abhimanyu

[Phil_Stevens]

Hi Abhimanyu,
I equally have the same issue.  I have literally just deployed HA FGT for Azure with ILB/ELB, from Marketplace, and for all the interfaces it created it asked for private addressing. I assume the PIPs will be on the ELB, and there should be one for the management port and one for the "external" interface, (port1). 

I have made no other configuration changes since the deployment from Marketplace. 

The results I get from the commands you suggested above are:
# get system arp
Address Age(min) Hardware Addr Interface
10.98.0.65 0 12:34:56:78:9a:bc port2
10.98.0.1 0 12:34:56:78:9a:bc port1

# diag ip arp list
index=16 ifname=fortilink 224.0.0.22 01:00:5e:00:00:16 state=00000040 use=137600418 confirm=137606454 update=137600454 ref=0
index=12 ifname=root 0.0.0.0 00:00:00:00:00:00 state=00000040 use=20455 confirm=20455 update=137570783 ref=0
index=5 ifname=port2 10.98.0.65 12:34:56:78:9a:bc state=00000002 use=581 confirm=582 update=51587680 ref=1
index=4 ifname=port1 10.98.0.1 12:34:56:78:9a:bc state=00000002 use=42 confirm=49 update=137600260 ref=1

# get router info routing-table details 8.8.8.8

Routing table for VRF=0
Routing entry for 0.0.0.0/0
Known via "static", distance 10, metric 0, best
* vrf 0 10.98.0.1, via port1

# diag sniffer packet any "host 8.8.8.8 and icmp" 4 0 a
Using Original Sniffing Mode
interfaces=[any]
filters=[host 8.8.8.8 and icmp]
2024-11-22 11:53:03.846037 port1 out 10.98.0.4 -> 8.8.8.8: icmp: echo request
2024-11-22 11:53:03.846043 sriovslv0 out 10.98.0.4 -> 8.8.8.8: icmp: echo request
2024-11-22 11:53:04.846151 port1 out 10.98.0.4 -> 8.8.8.8: icmp: echo request
2024-11-22 11:53:04.846161 sriovslv0 out 10.98.0.4 -> 8.8.8.8: icmp: echo request
2024-11-22 11:53:05.846348 port1 out 10.98.0.4 -> 8.8.8.8: icmp: echo request
2024-11-22 11:53:05.846357 sriovslv0 out 10.98.0.4 -> 8.8.8.8: icmp: echo request
2024-11-22 11:53:06.846556 port1 out 10.98.0.4 -> 8.8.8.8: icmp: echo request
2024-11-22 11:53:06.846568 sriovslv0 out 10.98.0.4 -> 8.8.8.8: icmp: echo request
2024-11-22 11:53:07.846846 port1 out 10.98.0.4 -> 8.8.8.8: icmp: echo request
2024-11-22 11:53:07.846858 sriovslv0 out 10.98.0.4 -> 8.8.8.8: icmp: echo request

So, it sees the default route as being via port 1, and therefore the route to 8.8.8.8 via port 1, and it can see the pings being sent, but no response. 

Obviously, until I can get basic communications functioning, I don't stand a chance of establishing VPNs back to the main on-premise site etc. 

I assume something would need to be configured on the ELB somewhere to allow the traffic?

Any help greatly received. 

Many thanks. 
Phil 

[JW2]

Hi Phil, 

in Azure there are some methods possible.

If you use the Azure External-LB you must configure an outgoing Loadbalancer Rule 

Source Network Address Translation (SNAT) for outbound connections - Azure Load Balancer | Microsoft...

BR 

JW

[Phil_Stevens]

Thanks JW.  Much appreciated.  That makes sense. We'll take a look to see if that resolves our issue. 

Best Regards

Phil