Reach Network on 2nd WAN Interface

[SebastianFromCologne]

Hi friends,

perhaps you can help?

I have two different networks (NW1 and NW2). NW2 can only be reached when i use a sprcific IP as next-hop or Gateway from NW1.

At the moment i can't reach NW2. Is there something i do wrong?

- I added NW to WAN1 and NW2 to WAN2.

- After that i created a static route with destination NW2 on WAN1 (NW1).

- After that i created a firewall policy, to allow traffic. 

When i try to reach a system on NW2 its not reachable.

Could help me to solve this?

Best regards

Sebastian

[AEK]

Hi Sebastian

It not clear enough.. Can you add a drawing with all routers in this network?

[SebastianFromCologne]

Hi, will try to make it clearer.

from my provider i got two networks.

NW1 and NW2 (for my services with some public IPs set to this network)

Two cables. Both of them have the same configuration, so i can use both or just one cable.

In my setup i use both cables, one on wan1 and one on wan2

NW1 is directly connected to interface wan1 and is reachable.

NW2 can only be reached by using a gateway, a specific IP from NW1.

My problem is, that i can't reach NW2 from external devices.

I created a static route with Destination NW2 and as Gateway the specific IP from NW1 on port wan1. When i ask the router, it displays, that the route NW2 is known via Gateway from NW1. It seems that settings is correct.

After that i created a VIP on WAN2 (NW2) to make the service available

After that i created a policy from WAN2 to Internal, to reach the service in the internal network.

The policy lookup displays that i have no explicit policy from wan2 to internal.

But why i configured that policy already.

Hope that makes it clearer?

Best regards

Sebastian

[esalija]

 Hi @SebastianFromCologne 

Please run the below commands and check where the traffic is flowing into the FortiGate and the policy that should match.

1. SSH Connection 1 - Packet Sniffer:

# diagnose sniffer packet any "host <Source_IP> and host <Destination_IP>" 4 0 l

To disable: CTRL+C

2. SSH Connection 2 - Debug Flow:

Resetting Debugs:

# diagnose debug reset

Debug Flow commands:

# diagnose debug flow filter addr <Source_IP> <Destination_IP> and
# diagnose debug flow show function-name enable
# diagnose debug console timestamp enable
# diagnose debug flow trace start 1000
# diagnose debug enable

Disabling the debugs:

# diagnose debug reset

3. SSH Connection 3 - Routing Tables:

# get router info routing-table all
# get router info routing-table database
# get router info routing-table details <Source_IP>
# get router info routing-table details <Destination_IP>

Best regards,

Erlin

[SebastianFromCologne]

Hi Erlin,

checked this. No Packets will received by sniffer, the Debugger shows also nothing.

The routing table tells me, that the NW2 is known via WAN1.

The router info for the destination ip is known via static and directly connected to wan2.

Do you have any ideas? Perhaps this a topic on the providers side?

Best regards

Sebastian

[AEK]

I'm not sure if this is relevant in this case but have you configured a route back on NW2?

[esalija]

Hi Sebastian,

Thank you for the answer.

If on the FortiGate you don't see any packets that are coming in and the configuration is correct, please check the upstream device, and what happened with the traffic there.

Best regards,

Erlin

[SebastianFromCologne]

Hi Erlin,

can't check the upstream device because its on the providers side.

In my opionion, my config is correct because on the policy lookup matches, the routing table shows that the route to NW2 is known.

Not sure, what to do now.

I tried to apply all on WAN1 as secondary IP because NW2 is also availabe on the cable on wan1, reconfigured all policies and it's the same problem.

@AEK 

Yes i think about it too, but on what gateway? For the Route to NW2 i have a gateway dcoumented from NW1 but on NW2 there is only the information about the Network and the range of host ips but no information about a gateway or next-hop.

[esalija]

Hi Sebastian,

For the WAN 2 are you able to ping the gateway for WAN 2?

If you are not able to ping it, that the problem is with the provider.

#  execute ping-options interface WAN2

#  execute ping <gateway IP of WAN 2>

Best regards,

Erlin