[Resolved] L2TP VPN cannot ping internal IP (only fw IP)

[#1]

I followed the guide. The windows 7 clients connects without problem. When I' m connected I can ping only the fw IP not other. Any suggestion? Graziano

[#2]

Hi Graziano! Both, you and me are riding the same path. Maybe my experience can help you and viceversa. When connected to the VPN it is normal you can only ping the Fortinet device' s IP because that is your default gateway. How can you know that? In a console Windows type: " route print" and you will notice that to reach your XX.XX.XX.XX remote private network you need to go out from the IP address showed there (your gateway and also the public IP address of the remote network). OK! But why can' t you ping any other computer on the remote network? Well, there are many scenarios and it all depends on your infrastructure: do you have any internal-remote DNS server or WINS (NetBIOS) server? If not, then that is the problem... I explain myself...when you are connected to the VPN I think there is no way to config a DNS/WINS server in the Fortinet device. So, once you are connected the DNS servers used for name resolution probably are your ISP' s DNS servers and they do NOT know nothing about your remote-private network...which really makes sense, isn' t it? So, when you config your VPN connection in Windows 7, you MUST specify a DNS server in order to ping by name any other host at the remote network. That DNS servermust be a guy that knows everything about your private remote network: an internal DNS server. If you want to be able to ping by hostname and don' t want to setup a DNS server, you must know that broadcast NETBIOS packets are not forwarded to another network because routers don' t allow that (which is good). So, you have a couple of options: setup a WINS server at the remote-private network or use a DNS server (I prefer this last one; FortiOS allows you to config an internal DNS server which can forward internet DNS queries to your ISP' s DNS servers). If you are still unable to ping by IP address any host at the remote network, then you must check your client' s Windows 7 firewall, any policy at the Fortinet device, and as the last resource: you can use a sniffer like Wireshark. Hope this helps...and good luck!

[#3]

Hi Julio. I' ve found my problem. I' m migrating from a 100A to 110C. Now all client point to 100A as default gataway. Indeed I cannot ping them. Yesterday I tryed to change a gateway client to 110C and miracle!. I can ping it. I decided to wait next week when the migration will be done. BR, Graziano.