Help
Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
ShahafCZ
New Contributor

Created on ‎11-22-2021 06:42 AM

Please help. Strangest thing ever...

Hi all,

 

I have a LAN connected to the internet using a FortiGate 60D.

Clients gets an IP Address from DHCP on the the scope of 192.168.1.101-130.

 

When a client gets an odd ip (ex. 192.168.1.101, 192.168.1.103, 192.168.1.105, etc. ....) they can connect to the internet without any problem.

 

When a client gets an even ip (ex. 192.168.1.102, 192.168.1.104, 192.168.1.106, etc. ...) they can NOT connect to the internet. their DHCP lease looks fine. they get a default gateway and all other configuration and they can access the LAN but for some reason the FortiGate blocks them from going on the Internet. They can ping the default gateway but not any hop behind it.

 

As a temporary solution I excluded all even numbers from the scope.

 

Any ideas of what can cause this behavior?  

 

Labels:
6502
0 Kudos
2 Solutions
GDiFi
Staff
Staff

Created on ‎11-22-2021 07:06 AM

It sounds like you have load balancing turned on.  The traffic is being load balanced between a good interface and one that you do not intend for it to use.  This issue was seen by another community member and they found they had their secondary WAN interface setup but was not usable.

 

https://community.fortinet.com/t5/Fortinet-Forum/No-internet-access-for-odd-IP-addresses/m-p/79209?m...

 

 

View solution in original post

6496
0 Kudos
pciurea
Staff
Staff
In response to ShahafCZ

Created on ‎11-22-2021 08:08 AM

It seems you have a ECMP condition (https://en.wikipedia.org/wiki/Equal-cost_multi-path_routing) and the FG will try to load balance the traffic between the two connections (ppp1 and ppp2). A load balancing algorithm is used to decide where the traffic goes through  - check the default one (https://docs.fortinet.com/document/fortigate/6.2.9/cookbook/25967/equal-cost-multi-path) .The default static route is automatically added after the ppp connection is up. Is seems that maybe one of your ppp conection has issues.

To avoid load-balancing, you can alter the distance/priority of the default route that is injected in the routing table either in the GUI or the cli under the interface configuration.

"Serenity now. Insanity later"

View solution in original post

6477
0 Kudos
11 REPLIES 11
ConnyGustavsson
New Contributor III

Created on ‎11-24-2021 12:47 AM

Hi. Faulty subnet mask on the firewall?
/Conny

cogus
cogus
1064
0 Kudos
ShahafCZ
New Contributor
In response to ConnyGustavsson

Created on ‎11-24-2021 12:01 PM

No. It was load balancing with ECMP condition.

1057
0 Kudos
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors
View all
Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Social Media
Security Research
Company
News & Articles
Contact Us

Copyright 2024 Fortinet, Inc. All Rights Reserved.