Policy LAN-to-LAN does not work

[Daniel_H]

Hi Gurus,

I have problem in my rules from LAN (private IP) to LAN (public IP)/(private IP). My FG-1500D has 4 ports used, single VDOM, FOS 5.2.2 (GA).

port26 - connected to ISP

port22 - connected to 103.x.x.x/25

port23 - connected to 172.27.18.0/24

port34 - create some vlans, i.e 172.27.1.0/24, 172.27.2.0/24, etc

I have static route to internet, via port26. I have all routing for all ip subnet and ports in monitor, and look works correctly. I have policies:

1. from all ports to port26, its working properly

2. from port26 to port22, its working properly

3. from port34 (vlans) to port22, it DOES NOT work

4. from port34 (vans) to port23, it DOES NOT work

5. from port23 to port22, it DOES NOT work

I need some advises to solve this problem..

Many thanks,

Regards,

Daniel

[theG]

Hi Daniel,

I'd look at using policy routes. You can then set your source addresses and destination addresses and select which port it should go out...

In the GUI...go to router>static>policy route. You'll see that you can select your incoming and outgoing interfaces with addresses. I'd leave the gateway address as is as you routing internally.

Goodluck

[ashukla_FTNT]

theG wrote:

Hi Daniel,

I'd look at using policy routes. You can then set your source addresses and destination addresses and select which port it should go out...

In the GUI...go to router>static>policy route. You'll see that you can select your incoming and outgoing interfaces with addresses. I'd leave the gateway address as is as you routing internally.

Goodluck

I don't see a reason why we have to use policy route. Normal routing should work.

Post the routing table from routing monitor and policies.

Also run the flow debug to check why traffic is not working:

diag debug reset

diag debug disable

diag debug enable

diag debug flow filter proto 1

diag debug flow show console enable

diag debug console timestamp enable

diag debug flow trace start 20

Start the ping from networks which are not working and once you have done the ping from all the affected network, disable the debug:

diag debug disable

Post the output.

[Daniel_H]

ashukla wrote:

theG wrote:

Hi Daniel,

I'd look at using policy routes. You can then set your source addresses and destination addresses and select which port it should go out...

In the GUI...go to router>static>policy route. You'll see that you can select your incoming and outgoing interfaces with addresses. I'd leave the gateway address as is as you routing internally.

Goodluck

I don't see a reason why we have to use policy route. Normal routing should work.

Post the routing table from routing monitor and policies.

Also run the flow debug to check why traffic is not working:

diag debug reset

diag debug disable

diag debug enable

diag debug flow filter proto 1

diag debug flow show console enable

diag debug console timestamp enable

diag debug flow trace start 20

Start the ping from networks which are not working and once you have done the ping from all the affected network, disable the debug:

diag debug disable

Post the output.

Hi Ashukla,

I'll do the debug.

Thanks.

Regards,

Daniel

[Daniel_H]

ashukla wrote:

theG wrote:

Hi Daniel,

I'd look at using policy routes. You can then set your source addresses and destination addresses and select which port it should go out...

In the GUI...go to router>static>policy route. You'll see that you can select your incoming and outgoing interfaces with addresses. I'd leave the gateway address as is as you routing internally.

Goodluck

I don't see a reason why we have to use policy route. Normal routing should work.

Post the routing table from routing monitor and policies.

Also run the flow debug to check why traffic is not working:

diag debug reset

diag debug disable

diag debug enable

diag debug flow filter proto 1

diag debug flow show console enable

diag debug console timestamp enable

diag debug flow trace start 20

Start the ping from networks which are not working and once you have done the ping from all the affected network, disable the debug:

diag debug disable

Post the output.

Hi Ashukla,

Can I do ping from FGT interface instead of using user's PC, as example

exec ping-options source 172.27.1.1

exec ping 103.x.x.102

Regards.

Daniel

[ashukla_FTNT]

I will recommend doing it form pc as self generated packet handling is different form pass-through traffic and doing from firewall might not give the clear picture.

[Daniel_H]

ashukla wrote:

I will recommend doing it form pc as self generated packet handling is different form pass-through traffic and doing from firewall might not give the clear picture.

Hi Ashukla,

attached document from debug

Regards,

Daniel

[Daniel_H]

theG wrote:

Hi Daniel,

I'd look at using policy routes. You can then set your source addresses and destination addresses and select which port it should go out...

In the GUI...go to router>static>policy route. You'll see that you can select your incoming and outgoing interfaces with addresses. I'd leave the gateway address as is as you routing internally.

Goodluck

I did this, it doesn't work.

Thank you...

Regards,

Daniel

[theG]

Just a quick question....you have created firewall policies to allow traffic between the interfaces right?

[Daniel_H]

theG wrote:

Just a quick question....you have created firewall policies to allow traffic between the interfaces right?

yes I do...