Ping-options

[yaabdullah]

Hallo forum,

i have this question and i did do the example structure in a Photo to make it easier to understand. so plz see the attachment.

We have two Fortigate 30E and they have connection to each other with VPN and every thing is working fine.

Now i want to do ping from Firewall CLI to make sure that the two LAN Network are connecting to each other.

VPN is green

policy is there 

Static routes is there also. 

and ping is active on the Interfaces.

but i still cannt ping the devices from the other Network from CLI firewall1

what i am doing on CLI-Firewall1:

[style="background-color: #000000;"]execute ping-options source 192.168.1.102[/style]

[style="background-color: #000000;"]execute ping 192.168.2.102[/style]

or

[style="background-color: #000000;"]execute ping-options interface lan1[/style]

[style="background-color: #000000;"]execute ping 192.168.2.102[/style]

[style="background-color: #ffffff;"]you should also know that the ping is possible when i do ping directly from the device but not from the Firewall.[/style]

[style="background-color: #ffffff;"]THANKS FOR HELPING[/style]

[lobstercreed]

Why would you want/need to do this?  You just said it works fine between the actual hosts and that's what you're trying to achieve with the VPN anyway, right?  Seems like you're creating trouble where there doesn't need to be any...

[yaabdullah]

@ lobstercreed i wrote in these Post just an Example but i need these actually in work for administration and Troubleshooting for lots of our Customers Firewalls!!!!

[Toshi_Esumi]

Wrong option. See below. But just keep it in mind the pinging from the FGT doesn't refer to any policies, which would otherwise go through if it's from actual devices behind the ingress interface. So if you NAT the traffic, then if you ping from the FGT specifying the ingress interface IP, it might not reach the destination or the destination might not recognize the source IP to return. "pint-option source" just picks the specific IP when it sends out ping from the egress interface.

In your case, into the tunnel, it probably works unless you NAT traffic into the tunnel.

XXX-fg1 # execute ping-o interface ? <string>    Auto | <outgoing interface>. XXX-fg1 # execute ping-o source <xxx.xxx.xxx.xxx>    <source interface IP> | Auto

sea5601-fg1 # execute traceroute-options source 10.x.0.1

XXX-fg1 # execute ping 10.0.x.x PING 10.0.x.x (10.0.x.x): 56 data bytes 64 bytes from 10.0.x.x: icmp_seq=0 ttl=126 time=18.6 ms 64 bytes from 10.0.x.x: icmp_seq=1 ttl=126 time=18.4 ms ^C

[Toshi_Esumi]

Sorry I copied a wrong line. I tested traceroute as well. I meant to include below instead.

xxx-fg1 # execute ping-o source 10.x.0.1