Dears,
I have fortigate 40c, it is deployed behind a modem connected to internet.
it was with release 5.0, and it has a policy to route internal interface to wan1.
it was working very well.
After I upgraded it to v 5.2, the users connected to internal interface have lost the connectivity to internet.
i didn't change any configuration, just upgrade.
i reviewed the configuration, but seems nothing incorrect.
the device itself has internet, as i can ping to internet websites from its CLI.
is it DNS issue, and how can i solve, please advise.
BR
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
So what have you done to troubleshoot this from the client side? Are you able to ping the default gw address, a place on the Internet by FQDN and IP address? Have you tried pinging Google's DNS? (8.8.8.8)? Are you able to ping a client device from the 40C?
Does the count column on the firewall policy list show any traffic on any of the policies?
If you are using FortiGuard web filtering did you check to see if the 40C can connect/access the FortiGuard servers?
NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
Thanks for reply.
to troubleshoot this from the client side, i was able to ping the IP of internal interface. but not able to ping 8.8.8.8 or any FQDN.
i can ping a client device. i have AP connected to internal interface. and through it i'm getting ip from DHCP of internal interface.
i can browse FG management interface, using internal interface IP or WAN1 IP.
Yes, the column of the policy shows traffic.
I don't have FortiGuard.
when i troubleshoot the connectivity from Internet explorer, i'm getting a message that your PC is not able to communicate with the DNS.while from FG itself i can access internet.
Hi! doesnt seems a DNS issue, because you can't ping 8.8.8.8 from a workstation. i am right?
you have two options:
First one, check all your configuration and see what is wrong...and you can be a week without Internet.
Second choice (i go with this one), you can troubleshoot this issue doing this:
1) in the workstation (just for the example, lets we say the ip of the workstation is teh 192.168.1.100), open a cmd a do a ping 8.8.8.8 -t
2) In fortigate, open a CLI and write this commands:
diagnose debug disable
diagnose debug reset
diagnose debug flow filter saddr 192.168.1.100
diagnose debug flow filter daddr 8.8.8.8
diagnose debug flow filter proto 1
diagnose debug flow show trace start 100
diagnose debug enable
and voila! the fortigate will say to you what is doing with your traffic, if you dont understand it, please copy and paste the ten or maybe fifteen lines from the debug and we will continue with the troubleshoot.
Bye!
See the below post for a probable solution.
https://forum.fortinet.com/tm.aspx?m=99159
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
Dear all,
Many Thanks for your support.
Issue has been solved.
I just edited the config file using notepad++ then searched for "config firewall service custom"
and under it I added one line: set protocol-number 0
config firewall service custom edit "ALL" set category "General" set protocol IP set protocol-number 0 "newly added" next
then I saved and uploaded the file again. after that I got everything working like before.
thank you every body and especially Mr.Jan Scholten who posted this solution, and Mr.rwpatterson who mentioned the link of that case.
Regards,
Hey
I hope you can help me with this problem now.
I am using 60D with FortiOS 6.0.9. I have got a FortiAP221B recently and connected in Interface2 and tried the step mentioned by you and got the below error, from which I understand that I am not receiving any response. Meanwhile I connected a Tenda router to interface 1 and it works seemlessly. I really appreciate your help here. Thanks in advance.
856.675169 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request
859.167094 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request
861.197421 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request
863.226837 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request
865.254402 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request
867.286822 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request
911.512224 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request
912.024522 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request
914.053832 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1698 | |
1092 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.