No internet connection

[Mossab]

Dears,

I have fortigate 40c, it is deployed behind a modem connected to internet.

it was with release 5.0, and it has a policy to route internal interface to wan1.

it was working very well.

After I upgraded it to v 5.2, the users connected to internal interface have lost the connectivity to internet.

i didn't change any configuration, just upgrade.

i reviewed the configuration, but seems nothing incorrect.

the device itself has internet, as i can ping to internet websites from its CLI.

is it DNS issue, and how can i solve, please advise.

BR

[Dave_Hall]

So what have you done to troubleshoot this from the client side?  Are you able to ping the default gw address, a place on the Internet by FQDN and IP address?  Have you tried pinging Google's DNS? (8.8.8.8)?  Are you able to ping a client device from the 40C?

Does the count column on the firewall policy list show any traffic on any of the policies?

If you are using FortiGuard web filtering did you check to see if the 40C can connect/access the FortiGuard servers?

[Mossab]

Thanks for reply.

to troubleshoot this from the client side, i was able to ping the IP of internal interface. but not able to ping 8.8.8.8 or any FQDN.

i can ping a client device. i have AP connected to internal interface. and through it i'm getting ip from DHCP of internal interface.

i can browse FG management interface, using internal interface IP or WAN1 IP.

Yes, the column of the policy shows traffic.

I don't have FortiGuard.

when i troubleshoot the connectivity from Internet explorer, i'm getting a message that your PC is not able to communicate with the DNS.while from FG itself i can access internet.

[Iescudero]

Hi! doesnt seems a DNS issue, because you can't ping 8.8.8.8 from a workstation. i am right?

you have two options:

First one, check all your configuration and see what is wrong...and you can be a week without Internet.

Second choice (i go with this one), you can troubleshoot this issue doing this:

1) in the workstation (just for the example, lets we say the ip of the workstation is teh 192.168.1.100), open a cmd a do a ping 8.8.8.8 -t

2) In fortigate, open a CLI and write this commands:

diagnose debug disable

diagnose debug reset

diagnose debug flow filter saddr 192.168.1.100

diagnose debug flow filter daddr 8.8.8.8

diagnose debug flow filter proto 1

diagnose debug flow show trace start 100

diagnose debug enable

and voila! the fortigate will say to you what is doing with your traffic, if you dont understand it, please copy and paste the ten or maybe fifteen lines from the debug and we will continue with the troubleshoot.

Bye!

[rwpatterson]

See the below post for a probable solution.

https://forum.fortinet.com/tm.aspx?m=99159

[Mossab]

Dear all,

Many Thanks for your support.

Issue has been solved.

I just edited the config file using notepad++ then searched for "config firewall service custom"

and under it I added one line: set protocol-number 0

config firewall service custom     edit "ALL"         set category "General"         set protocol IP         set protocol-number 0              "newly added"     next

then I saved and uploaded the file again. after that I got everything working like before.

thank you every body and especially Mr.Jan Scholten who posted this solution, and Mr.rwpatterson who mentioned the link of that case.

Regards,

[frankz]

Hey

I hope you can help me with this problem now.

I am using 60D with FortiOS 6.0.9. I have got a FortiAP221B recently and connected in Interface2 and tried the step mentioned by you and got the below error, from which I understand that I am not receiving any response. Meanwhile I connected a Tenda router to interface 1 and it works seemlessly. I really appreciate your help here. Thanks in advance.

856.675169 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request

859.167094 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request

861.197421 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request

863.226837 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request

865.254402 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request

867.286822 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request

911.512224 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request

912.024522 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request

914.053832 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request