Policy LAN-to-LAN does not work

[Daniel_H]

Hi Gurus,

I have problem in my rules from LAN (private IP) to LAN (public IP)/(private IP). My FG-1500D has 4 ports used, single VDOM, FOS 5.2.2 (GA).

port26 - connected to ISP

port22 - connected to 103.x.x.x/25

port23 - connected to 172.27.18.0/24

port34 - create some vlans, i.e 172.27.1.0/24, 172.27.2.0/24, etc

I have static route to internet, via port26. I have all routing for all ip subnet and ports in monitor, and look works correctly. I have policies:

1. from all ports to port26, its working properly

2. from port26 to port22, its working properly

3. from port34 (vlans) to port22, it DOES NOT work

4. from port34 (vans) to port23, it DOES NOT work

5. from port23 to port22, it DOES NOT work

I need some advises to solve this problem..

Many thanks,

Regards,

Daniel

[Daniel_H]

ashukla wrote:

teri.ireng wrote:

Hi,

I have problem accessing port22, some IP address accessible but some can not reach. I can ping from FGT's interface to the servers. But only some IP response from other side (LAN). Here is the capture from debug..

2015-02-20 19:15:29 id=20085 trace_id=453 func=print_pkt_detail line=4373 msg="vd-root received a packet(proto=1, 172.27.219.254:34075->103.229.202.78:8) from vlan_staf_aruba. code=8, type=0, id=34075, seq=16." 2015-02-20 19:15:29 id=20085 trace_id=453 func=init_ip_session_common line=4522 msg="allocate a new session-0214e4ad" 2015-02-20 19:15:29 id=20085 trace_id=453 func=fw_local_in_handler line=382 msg="iprope_in_check() check failed on policy 0, drop"

Need your help ASAP.. thank you.

Daniel

Check if you have any ip-pool configured for ip 103.229.202.78.

Check if ip-pool range contains this ip and if so remove it.

Hi Ashukla,

May I know, from which part of the debug log you can specify the problem is in ip-pool?

Is it documented? If yes, would share it?

Thank you,

Daniel

[ashukla_FTNT]

Hi Ashukla,

May I know, from which part of the debug log you can specify the problem is in ip-pool?

Is it documented? If yes, would share it?

Thank you,

Daniel

msg="iprope_in_check() check failed on policy 0, drop

When you see iprope_in_check for pass through traffic that means there is an ip-pool created for destination address.

Ip-pool is for source nat so we don't allow/expect new packet hitting ip-pool ip as destination.

Not sure if it is documented.

Some other reason for this error is mentioned in following KB:

http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD31702&sliceId=1...

[Daniel_H]

ashukla wrote:

Hi Ashukla,

May I know, from which part of the debug log you can specify the problem is in ip-pool?

Is it documented? If yes, would share it?

Thank you,

Daniel

msg="iprope_in_check() check failed on policy 0, drop

When you see iprope_in_check for pass through traffic that means there is an ip-pool created for destination address.

Ip-pool is for source nat so we don't allow/expect new packet hitting ip-pool ip as destination.

Not sure if it is documented.

Some other reason for this error is mentioned in following KB:

http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD31702&sliceId=1...

Hi Asukhla,

This morning I got complain from customer, an area cannot be accessed from wifi. This is the debug log message...

2015-02-23 08:55:05 id=20085 trace_id=553 func=print_pkt_detail line=4373 msg="vd-root received a packet(proto=1, 172.27.216.3:56023->103.229.202.122:8) from vlan_prkt_aruba. code=8, type=0, id=56023, seq=41." 2015-02-23 08:55:05 id=20085 trace_id=553 func=init_ip_session_common line=4522 msg="allocate a new session-04bdfc65" 2015-02-23 08:55:05 id=20085 trace_id=553 func=ip_route_input_slow line=1273 msg="reverse path check fail, drop"

Regards,

Daniel

[ashukla_FTNT]

reverse patch check failed.

Firewall will check the route for the source ip address (172.27.216.3) through interface vlan_prkt_aruba and if there is no route then it will be dropped. 

Check and make sure you have a route to 172.27.216 network is there through interface vlan_prkt_aruba

[Daniel_H]

ashukla wrote:

reverse patch check failed.

Firewall will check the route for the source ip address (172.27.216.3) through interface vlan_prkt_aruba and if there is no route then it will be dropped. 

Check and make sure you have a route to 172.27.216 network is there through interface vlan_prkt_aruba

Hi,

subnet 172.27.216.0/22 is in vlan called "vlan_prkt_aruba" create on fortigate's port34 (10GbE) , with ip address 172.27.216.1. And I have routing for this subnet, type connected.

The policy for this traffic is route, then I change to NAT. After changes, the traffic can flow normally.

Is there any other problem in this case?

Regards,

Daniel