Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Gordon6517
New Contributor

Strange issue with Fortigate

Hi All,

 

I am having a strange issue with one of our Fortigate HA pair. I have a multi vdom setup and all vdoms are working fine except one.

 

One of the boxes restarted yesterday. The failover occurred but now for one of the VDOM, the routing is not working. I have a default route configured. I can ping the GW but can not ping from the GW. I have checked that ping is allowed.

 

When I try to send traffic out to the internet, the traffic is not even getting to the GW. I have tried restarting the box as well as the routing engine. This was a working setup and no changes have been made at all except for the failover yesterday.

 

Can anyone help?

 

Thanks

5 REPLIES 5
Sanjay1
New Contributor

Hi,

 

First of all kindly make sure that traffic is hitting the firewall's interface or not using the debug command on CLI. If there's traffic on the incoming interface, the output of debug commands will give you all details like the policy id dropping/accepting traffic, next hop, if the routing is done right or not, etc. And if the output is blank ( no traffic hitting the interface) there must be some issue in the routing of the internal network. Kindly check routes on L3 switch/router and make sure the traffic is routed towards the firewall's interface.

 

Hope it's helpful, thanks. 

MikePruett
Valued Contributor

make sure you don't have an IP Pool that includes your GW's IP. That burned a client of mine when they upgraded and I caught it for them after they already went down. 

Mike Pruett Fortinet GURU | Fortinet Training Videos
Dani_Royman_Simanjun
New Contributor

you must call Fortigate support for anomaly hardware problems.

emnoc
Esteemed Contributor III

I would do

 

cli cmd diag sys arp list  ( do you see the GW address )

cli cmd  get router info routing all ( does the RIB look correct ) 

cli cmd diag sniffer packet <GW INTERFACE NAME > ( do you see traffic )

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
rwpatterson
Valued Contributor III

This thread died a almost a year ago. I would think the OP has gotten this taken care of...

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors