Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

No internet connection



I have fortigate 40c, it is deployed behind a modem connected to internet.

it was with release 5.0, and it has a policy to route internal interface to wan1.

it was working very well.

After I upgraded it to v 5.2, the users connected to internal interface have lost the connectivity to internet.

i didn't change any configuration, just upgrade.

i reviewed the configuration, but seems nothing incorrect.

the device itself has internet, as i can ping to internet websites from its CLI.

is it DNS issue, and how can i solve, please advise.



Honored Contributor

So what have you done to troubleshoot this from the client side?  Are you able to ping the default gw address, a place on the Internet by FQDN and IP address?  Have you tried pinging Google's DNS? (  Are you able to ping a client device from the 40C?


Does the count column on the firewall policy list show any traffic on any of the policies?


If you are using FortiGuard web filtering did you check to see if the 40C can connect/access the FortiGuard servers?

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C

Thanks for reply.

to troubleshoot this from the client side, i was able to ping the IP of internal interface. but not able to ping or any FQDN.

i can ping a client device. i have AP connected to internal interface. and through it i'm getting ip from DHCP of internal interface.

i can browse FG management interface, using internal interface IP or WAN1 IP.

Yes, the column of the policy shows traffic.

I don't have FortiGuard.

when i troubleshoot the connectivity from Internet explorer, i'm getting a message that your PC is not able to communicate with the DNS.while from FG itself i can access internet.


Contributor II

Hi! doesnt seems a DNS issue, because you can't ping from a workstation. i am right?

you have two options:

First one, check all your configuration and see what is wrong...and you can be a week without Internet.

Second choice (i go with this one), you can troubleshoot this issue doing this:


1) in the workstation (just for the example, lets we say the ip of the workstation is teh, open a cmd a do a ping -t


2) In fortigate, open a CLI and write this commands:


diagnose debug disable

diagnose debug reset

diagnose debug flow filter saddr

diagnose debug flow filter daddr

diagnose debug flow filter proto 1

diagnose debug flow show trace start 100

diagnose debug enable


and voila! the fortigate will say to you what is doing with your traffic, if you dont understand it, please copy and paste the ten or maybe fifteen lines from the debug and we will continue with the troubleshoot.




Valued Contributor III

See the below post for a probable solution.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at:

Bob - self proclaimed posting junkie!See my Fortigate related scripts at:

Dear all,

Many Thanks for your support.

Issue has been solved.



I just edited the config file using notepad++ then searched for "config firewall service custom"

and under it I added one line: set protocol-number 0


config firewall service custom     edit "ALL"         set category "General"         set protocol IP         set protocol-number 0              "newly added"     next


then I saved and uploaded the file again. after that I got everything working like before.

thank you every body and especially Mr.Jan Scholten who posted this solution, and Mr.rwpatterson who mentioned the link of that case.






I hope you can help me with this problem now.

I am using 60D with FortiOS 6.0.9. I have got a FortiAP221B recently and connected in Interface2 and tried the step mentioned by you and got the below error, from which I understand that I am not receiving any response. Meanwhile I connected a Tenda router to interface 1 and it works seemlessly. I really appreciate your help here. Thanks in advance.

856.675169 Test in -> icmp: echo request
859.167094 Test in -> icmp: echo request
861.197421 Test in -> icmp: echo request
863.226837 Test in -> icmp: echo request
865.254402 Test in -> icmp: echo request
867.286822 Test in -> icmp: echo request
911.512224 Test in -> icmp: echo request
912.024522 Test in -> icmp: echo request
914.053832 Test in -> icmp: echo request


Top Kudoed Authors