Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Mossab
New Contributor

No internet connection

Dears,

 

I have fortigate 40c, it is deployed behind a modem connected to internet.

it was with release 5.0, and it has a policy to route internal interface to wan1.

it was working very well.

After I upgraded it to v 5.2, the users connected to internal interface have lost the connectivity to internet.

i didn't change any configuration, just upgrade.

i reviewed the configuration, but seems nothing incorrect.

the device itself has internet, as i can ping to internet websites from its CLI.

is it DNS issue, and how can i solve, please advise.

 

BR

6 REPLIES 6
Dave_Hall
Honored Contributor

So what have you done to troubleshoot this from the client side?  Are you able to ping the default gw address, a place on the Internet by FQDN and IP address?  Have you tried pinging Google's DNS? (8.8.8.8)?  Are you able to ping a client device from the 40C?

 

Does the count column on the firewall policy list show any traffic on any of the policies?

 

If you are using FortiGuard web filtering did you check to see if the 40C can connect/access the FortiGuard servers?

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
Mossab

Thanks for reply.

to troubleshoot this from the client side, i was able to ping the IP of internal interface. but not able to ping 8.8.8.8 or any FQDN.

i can ping a client device. i have AP connected to internal interface. and through it i'm getting ip from DHCP of internal interface.

i can browse FG management interface, using internal interface IP or WAN1 IP.

Yes, the column of the policy shows traffic.

I don't have FortiGuard.

when i troubleshoot the connectivity from Internet explorer, i'm getting a message that your PC is not able to communicate with the DNS.while from FG itself i can access internet.

 

Iescudero
Contributor II

Hi! doesnt seems a DNS issue, because you can't ping 8.8.8.8 from a workstation. i am right?

you have two options:

First one, check all your configuration and see what is wrong...and you can be a week without Internet.

Second choice (i go with this one), you can troubleshoot this issue doing this:

 

1) in the workstation (just for the example, lets we say the ip of the workstation is teh 192.168.1.100), open a cmd a do a ping 8.8.8.8 -t

 

2) In fortigate, open a CLI and write this commands:

 

diagnose debug disable

diagnose debug reset

diagnose debug flow filter saddr 192.168.1.100

diagnose debug flow filter daddr 8.8.8.8

diagnose debug flow filter proto 1

diagnose debug flow show trace start 100

diagnose debug enable

 

and voila! the fortigate will say to you what is doing with your traffic, if you dont understand it, please copy and paste the ten or maybe fifteen lines from the debug and we will continue with the troubleshoot.

 

Bye!

 

rwpatterson
Valued Contributor III

See the below post for a probable solution.

 

https://forum.fortinet.com/tm.aspx?m=99159

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
Mossab

Dear all,

Many Thanks for your support.

Issue has been solved.

 

 

I just edited the config file using notepad++ then searched for "config firewall service custom"

and under it I added one line: set protocol-number 0

 

config firewall service custom     edit "ALL"         set category "General"         set protocol IP         set protocol-number 0              "newly added"     next

 

then I saved and uploaded the file again. after that I got everything working like before.

thank you every body and especially Mr.Jan Scholten who posted this solution, and Mr.rwpatterson who mentioned the link of that case.

 

 

Regards,

frankz

Hey

I hope you can help me with this problem now.

I am using 60D with FortiOS 6.0.9. I have got a FortiAP221B recently and connected in Interface2 and tried the step mentioned by you and got the below error, from which I understand that I am not receiving any response. Meanwhile I connected a Tenda router to interface 1 and it works seemlessly. I really appreciate your help here. Thanks in advance.

856.675169 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request
859.167094 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request
861.197421 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request
863.226837 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request
865.254402 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request
867.286822 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request
911.512224 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request
912.024522 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request
914.053832 Test in 192.168.2.2 -> 8.8.8.8: icmp: echo request
 

 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors