Ping to newly created PPPoE wan connection

[aseques]

I just set up a new wan connection, my provider requests a PPPoE connection to be done to retrieve the IP. Everything worked quite easily, but I can't ping the public interface of the fortigate in this wan (even if I allowed it in the properties)

What I see when debugging is this:

id=20085 trace_id=308 func=fw_local_in_handler line=385 msg="iprope_in_check() check failed on policy 0, drop"

id=20085 trace_id=309 func=print_pkt_detail line=4469 msg="vd-root received a packet(proto=1, 12.12.12.25:28675->22.22.22.86:8) from ppp1. code=8, type=0, id=28675, seq=1359."

id=20085 trace_id=309 func=init_ip_session_common line=4620 msg="allocate a new session-000d0cee"

id=20085 trace_id=309 func=fw_local_in_handler line=385 msg="iprope_in_check() check failed on policy 0, drop"

id=20085 trace_id=310 func=print_pkt_detail line=4469 msg="vd-root received a packet(proto=1, 12.12.12.25:28675->22.22.22.86:8) from ppp1. code=8, type=0, id=28675, seq=1360."

id=20085 trace_id=310 func=init_ip_session_common line=4620 msg="allocate a new session-000d0cf0"

How should I enable the ping/ssh/https in the wan interface in this case? I tried adding rules to various places without much success.

 a new PPPoE connection to my fiber 

[Toshi_Esumi]

Sounds like trusthost settings doing it like below:

https://forum.fortinet.com/tm.aspx?m=118313

[aseques]

Thanks for your reply, it was indeed the cause of the original issue, now the first PPPoE is replying the pings without issues, on this new connection I have still a routing issue, apparently the traffic is going through the default gw instead of using the interface where it came from.

id=20085 trace_id=489 func=print_pkt_detail line=4469 msg="vd-root received a packet(proto=1, 12.12.12.25:7404->22.22.22.220:8) from ppp2. code=8, type=0, id=7404, seq=1."
id=20085 trace_id=489 func=init_ip_session_common line=4620 msg="allocate a new session-000dcafa"
id=20085 trace_id=490 func=print_pkt_detail line=4469 msg="vd-root received a packet(proto=1, 22.22.22.220:7404->12.12.12.25:0) from local. code=0, type=0, id=7404, seq=1."
id=20085 trace_id=490 func=resolve_ip_tuple_fast line=4530 msg="Find an existing session, id-000dcafa, reply direction"

[Toshi_Esumi]

So you have multiple internet connections in addition to this one. It of course follows the default route if there is only one. If you want to return packets going out where it comes in at those internet connections you need to have two default routes.

I haven't done load balancing myself but there are two ways to set up multiple paths described in another post below. I would try both and choose what works the best.

https://forum.fortinet.co...p;m=133473&mpage=1

Also there must be documentation and discussions for load balancing. But one thing I want to warn is if you happen to use 5.2.4, there is a specific bug related returning packet's direction even there are two default routes in the table. I would avoid it and use either 5.2.3 or 5.2.5.

[aseques]

Thanks for your help, unfortunately the static route prioritization is not possible with PPPoE connections, because they are dynamic (even if the ip address provided is always the same).

There is an option via CLI  to set the priority directly to the interface which should have the same effect, I did that, but although I had no more an inactive route the traffic still would come in via wan2 to go out via wan1.

At the end I had to take the most drastic approach, I disconnected the old connection (instead of doing it gradually) and everything started to work (except the sslvpn see here https://forum.fortinet.com/FindPost/133656), I suspect a bug in firmware but who knows.

[Toshi_Esumi]

We use below all the time and it works well except v5.2.4, which had a bug. In case PPPoE or DHCP interface you need to use "set dynamic-gateway enable" instead of IP address of the GW.

config router static     edit 1         set gateway <<GW2>>         set priority 10         set device "INT2"     next     edit 2         set gateway <<GW1>>         set device "INT1"     next end

[aseques]

Oh, your solution looks neat, I found about the other one here, as it reads:

That' s all there is to this topic. With PPPoE interfaces, you can set the priority only in the CLI (conf sys int, edit wan1, set priority ...).

Maybe in a newer version they fixed this or I didn't understood it properly. I'll take that into account for the next time.