PROBLEM:
-I can't ping from R1 to 23.23.23.1 or 23.23.23.2
-I can't ping from R2 to 31.31.31.1 or 31.31.31.2
-I can't ping from R3 to 13.13.13.1 or 13.13.13.2
Based on diagram below, what I missed in my steps
tq
INFO
R1 connected to Internet and NATed
FGT1 config system interface edit "port1" set vdom "root" set ip 10.0.10.61 255.255.255.0 set allowaccess ping https ssh http fgfm set type physical set snmp-index 1 next edit "port2" set vdom "root" set ip 12.12.12.1 255.255.255.252 set allowaccess ping https ssh http fgfm set type physical set snmp-index 2 next edit "port3" set vdom "root" set ip 31.31.31.2 255.255.255.252 set allowaccess ping https ssh http fgfm set type physical set snmp-index 3 next edit "port4" set vdom "root" set type physical set snmp-index 4 next edit "ssl.root" set vdom "root" set type tunnel set alias "SSL VPN interface" set snmp-index 5 next edit "loopback" set vdom "root" set ip 1.0.0.1 255.255.255.255 set type loopback set snmp-index 6 next end config firewall policy edit 1 set uuid ef6c951c-0627-51e6-739a-6ddf25cfc795 set srcintf "port2" "port3" set dstintf "port1" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "ALL" set nat enable next end config router static edit 1 set gateway 10.0.10.1 set device "port1" next end config router ospf set default-information-originate enable set router-id 1.0.0.1 config area edit 0.0.0.0 next end config ospf-interface edit "loopback" set interface "loopback" set ip 1.0.0.1 next end config network edit 1 set prefix 12.12.12.0 255.255.255.252 next edit 2 set prefix 31.31.31.0 255.255.255.252 next edit 3 set prefix 1.0.0.1 255.255.255.255 next end config redistribute "connected" end config redistribute "static" set status enable end config redistribute "rip" end config redistribute "bgp" end config redistribute "isis" end end FGT2 config system interface edit "port1" set vdom "root" set allowaccess ping https ssh http fgfm set type physical set snmp-index 1 next edit "port2" set vdom "root" set ip 12.12.12.2 255.255.255.252 set allowaccess ping https ssh http fgfm set type physical set snmp-index 2 next edit "port3" set vdom "root" set ip 23.23.23.1 255.255.255.252 set allowaccess ping https ssh http fgfm set type physical set snmp-index 3 next edit "port4" set vdom "root" set type physical set snmp-index 4 next edit "ssl.root" set vdom "root" set type tunnel set alias "SSL VPN interface" set snmp-index 5 next edit "loopback" set vdom "root" set ip 1.0.0.2 255.255.255.255 set type loopback set snmp-index 6 next end config router ospf set router-id 1.0.0.2 config area edit 0.0.0.0 next end config ospf-interface edit "loopback" set interface "loopback" set ip 1.0.0.2 next end config network edit 1 set prefix 12.12.12.0 255.255.255.252 next edit 2 set prefix 23.23.23.0 255.255.255.252 next edit 3 set prefix 1.0.0.2 255.255.255.255 next end config redistribute "connected" end config redistribute "static" end config redistribute "rip" end config redistribute "bgp" end config redistribute "isis" end end FGT3 config system interface edit "port1" set vdom "root" set allowaccess ping https ssh http fgfm set type physical set snmp-index 1 next edit "port2" set vdom "root" set ip 23.23.23.2 255.255.255.252 set allowaccess ping https ssh http fgfm set type physical set snmp-index 2 next edit "port3" set vdom "root" set ip 31.31.31.1 255.255.255.252 set allowaccess ping https ssh http fgfm set type physical set snmp-index 3 next edit "port4" set vdom "root" set type physical set snmp-index 4 next edit "ssl.root" set vdom "root" set type tunnel set alias "SSL VPN interface" set snmp-index 5 next edit "loopback" set vdom "root" set ip 1.0.0.3 255.255.255.255 set type loopback set snmp-index 6 next end config router ospf set router-id 1.0.0.3 config area edit 0.0.0.0 next end config ospf-interface edit "loopback" set interface "loopback" set ip 1.0.0.3 next end config network edit 1 set prefix 23.23.23.0 255.255.255.252 next edit 2 set prefix 31.31.31.0 255.255.255.252 next edit 3 set prefix 1.0.0.3 255.255.255.255 next end config redistribute "connected" end config redistribute "static" end config redistribute "rip" end config redistribute "bgp" end config redistribute "isis" end end1st
it looks like none of the interfaces are ospf speakers
2nd do you have ospf-adj with the neighbors ( r1 r2 r3 )
PCNSE
NSE
StrongSwan
R1# get router info routing-table all
S* 0.0.0.0/0 [10/0] via 10.0.10.1, port1 C 1.0.0.1/32 is directly connected, loopback O 1.0.0.2/32 [110/101] via 12.12.12.2, port2, 00:00:57 O 1.0.0.3/32 [110/101] via 31.31.31.1, port3, 00:00:57 C 10.0.10.0/24 is directly connected, port1 C 12.12.12.0/30 is directly connected, port2 O 23.23.23.0/30 [110/2] via 12.12.12.2, port2, 00:00:57 [110/2] via 31.31.31.1, port3, 00:00:57 C 31.31.31.0/30 is directly connected, port3
R2# get router info routing-table all
O*E2 0.0.0.0/0 [110/10] via 12.12.12.1, port2, 00:02:56 O 1.0.0.1/32 [110/101] via 12.12.12.1, port2, 00:02:56 C 1.0.0.2/32 is directly connected, loopback O 1.0.0.3/32 [110/101] via 23.23.23.2, port3, 00:02:56 C 12.12.12.0/30 is directly connected, port2 C 23.23.23.0/30 is directly connected, port3 O 31.31.31.0/30 [110/2] via 12.12.12.1, port2, 00:02:56 [110/2] via 23.23.23.2, port3, 00:02:56
R3# get router info routing-table all
O*E2 0.0.0.0/0 [110/10] via 31.31.31.2, port3, 00:03:32 O 1.0.0.1/32 [110/101] via 31.31.31.2, port3, 00:03:32 O 1.0.0.2/32 [110/101] via 23.23.23.1, port2, 00:03:32 C 1.0.0.3/32 is directly connected, loopback O 12.12.12.0/30 [110/2] via 23.23.23.1, port2, 00:03:32 [110/2] via 31.31.31.2, port3, 00:03:32 C 23.23.23.0/30 is directly connected, port2 C 31.31.31.0/30 is directly connected, port3
My problem solved by creating firewall policy
[link]https://nbctcp.wordpress.com/2016/04/20/ospf-labs/[/link]
Good, the diag debug flow is your best friend ;)
PCNSE
NSE
StrongSwan
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1759 | |
1116 | |
766 | |
447 | |
242 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2025 Fortinet, Inc. All Rights Reserved.