Pinging from one side

[Vernon76]

Hi all,

I have a fortigate 50b which has the address 192.168.1.xxx which has a pc A connected to it

A wireless router is connected to the firewall with the wan address in the same range 192.168.1.xx

The lan of the wireless is 192.168.2.xxx with a pc B connected to it.

When I ping from the pc B to 192.168.1.xx, I get a response, but  when pinging from PC A I  ping 192.168.2.xx.

I used execute ping the firewall to ping 192.168.2.xx, but get no response.

I'm trying to see all devices which have either Ip's to see each other.

Might someone know what I am missing in the configuration of the firewall?

Thank you in advance

[Fullmoon]

pls try

could you post your wireless router wan ip address (assuming 192.168.1.2)

create a static router under fortigate

Dst IP/Mask=192.168.2.0/24

Device=Internal

Gateway= 192.168.1.2 (wireless router wan ip add)

[Vernon76]

Hi Fullmoon,

I did create a static route, but I pointed to the wrong IP, my firewall which is in the same range as the WAN of the wireless.

I entered the ip of the WAN (192.168.1.2) of the wireless as you suggested, but still no go, also created one for viseversa

Still cannot ping 192.168.2.xx that have devices on it, from 192.168.1.xx

Krs

[Fullmoon]

:)

192.168.1.2 was only a sample ip address.

Could you pls post your fortigate local ip and wireless router wan ip address?

[Vernon76]

Hi Fullmoon,

My local ip of the fortigate is 192.168.1.11

As for the WAN of my wireless router it is 192.168.1.2 :D

The Lan is 192.168.2.1 of the wireless router.

Also tried a policy route for internal only from 192.168.1.0 to 192.168.2.0 and vise versa

Static route is just like I stated in the previous post.

krs,

[vjoshi_FTNT]

Hello,

I don't think policy route is needed here.

I am assuming your network topology as:

FGT(192.168.1.11) -->> Switch or (Switch interface of FGT) -->>(192.168.1.10)PC A / (192.168.1.2)Wireless router (192.168.2.1) -->> PC-B (192.168.2.10)

You can have below :

- Static route on the Fortigate to reach 192.168.2.0 via 192.168.1.2

- Default route on the Wireless router pointing the Fortigate Internal IP (192.168.1.11)

Above should cover the routing part.

Another thing you need to take care is :

- Is the wireless router doing the NAT ? or just the routing?

- If it is doing the NAT, then static route on the FGT is not needed

- If no NAT, then verify if there is Windows Firewall on PC-A or any third party AV which could be blocking the access

[Vernon76]

Ok, Thanks vjoshi_FTNT,

Checked on PC A and firewall is not active.

And the wireless is doing NAT.

But for some reason still can't ping from firewall it self to 192.168.2.1 (wireless ip connected directly to fortgate)

Krs,

[vjoshi_FTNT]

Vernon76 wrote:

Ok, Thanks vjoshi_FTNT,

Checked on PC A and firewall is not active.

And the wireless is doing NAT.

But for some reason still can't ping from firewall it self to 192.168.2.1 (wireless ip connected directly to fortgate)

Krs,

Hello,

In your scenario, 192.168.2.1 or any address on the 192.168.2.x subnet cannot be reached directly.

- As the Wireless is doing the NAT, you can only see 192.168.1.X subnet

- Wireless router should be configured to do a one to one NAT for all the IP addresses (If all the 192.168.2.X IP addresses must be reachable for all services individually)

 (OR) you can configure the Wireless router in the bridge mode

Hope that helps