Traffic has not forward to another interface

[producttechlab]

Perimiter-FW-1 # id=20085 trace_id=169 func=print_pkt_detail line=5867 msg="vd-root:0 received a packet(proto=17, 10.133.100.200:59286->8.8.8.8:53) tun_id=0.0.0.0 from port1. "
id=20085 trace_id=169 func=init_ip_session_common line=6046 msg="allocate a new session-000046dd, tun_id=0.0.0.0"
id=20085 trace_id=169 func=iprope_dnat_check line=5336 msg="in-[port1], out-[]"
id=20085 trace_id=169 func=iprope_dnat_tree_check line=827 msg="len=0"
id=20085 trace_id=169 func=iprope_dnat_check line=5348 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
id=20085 trace_id=169 func=vf_ip_route_input_common line=2611 msg="find a route: flag=00000000 gw-192.168.56.2 via port6"
id=20085 trace_id=170 func=print_pkt_detail line=5867 msg="vd-root:0 received a packet(proto=17, 10.133.100.200:59286->8.8.8.8:53) tun_id=0.0.0.0 from port1. "
id=20085 trace_id=170 func=init_ip_session_common line=6046 msg="allocate a new session-000046de, tun_id=0.0.0.0"
id=20085 trace_id=170 func=iprope_dnat_check line=5336 msg="in-[port1], out-[]"
id=20085 trace_id=170 func=iprope_dnat_tree_check line=827 msg="len=0"
id=20085 trace_id=170 func=iprope_dnat_check line=5348 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
id=20085 trace_id=170 func=vf_ip_route_input_common line=2611 msg="find a route: flag=00000000 gw-192.168.56.2 via port6"
id=20085 trace_id=171 func=print_pkt_detail line=5867 msg="vd-root:0 received a packet(proto=17, 10.133.100.200:57329->8.8.8.8:53) tun_id=0.0.0.0 from port1. "
id=20085 trace_id=171 func=init_ip_session_common line=6046 msg="allocate a new session-000046df, tun_id=0.0.0.0"
id=20085 trace_id=171 func=iprope_dnat_check line=5336 msg="in-[port1], out-[]"
id=20085 trace_id=171 func=iprope_dnat_tree_check line=827 msg="len=0"
id=20085 trace_id=171 func=iprope_dnat_check line=5348 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
id=20085 trace_id=171 func=vf_ip_route_input_common line=2611 msg="find a route: flag=00000000 gw-192.168.56.2 via port6"
id=20085 trace_id=172 func=print_pkt_detail line=5867 msg="vd-root:0 received a packet(proto=17, 10.133.100.200:59286->8.8.8.8:53) tun_id=0.0.0.0 from port1. "
id=20085 trace_id=172 func=init_ip_session_common line=6046 msg="allocate a new session-000046e0, tun_id=0.0.0.0"
id=20085 trace_id=172 func=iprope_dnat_check line=5336 msg="in-[port1], out-[]"
id=20085 trace_id=172 func=iprope_dnat_tree_check line=827 msg="len=0"
id=20085 trace_id=172 func=iprope_dnat_check line=5348 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
id=20085 trace_id=172 func=vf_ip_route_input_common line=2611 msg="find a route: flag=00000000 gw-192.168.56.2 via port6"
id=20085 trace_id=173 func=print_pkt_detail line=5867 msg="vd-root:0 received a packet(proto=17, 10.133.100.200:57329->8.8.8.8:53) tun_id=0.0.0.0 from port1. "
id=20085 trace_id=173 func=init_ip_session_common line=6046 msg="allocate a new session-000046e1, tun_id=0.0.0.0"
id=20085 trace_id=173 func=iprope_dnat_check line=5336 msg="in-[port1], out-[]"
id=20085 trace_id=173 func=iprope_dnat_tree_check line=827 msg="len=0"
id=20085 trace_id=173 func=iprope_dnat_check line=5348 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
id=20085 trace_id=173 func=vf_ip_route_input_common line=2611 msg="find a route: flag=00000000 gw-192.168.56.2 via port6"
id=20085 trace_id=174 func=print_pkt_detail line=5867 msg="vd-root:0 received a packet(proto=17, 10.133.100.200:57329->8.8.8.8:53) tun_id=0.0.0.0 from port1. "
id=20085 trace_id=174 func=init_ip_session_common line=6046 msg="allocate a new session-000046e2, tun_id=0.0.0.0"
id=20085 trace_id=174 func=iprope_dnat_check line=5336 msg="in-[port1], out-[]"
id=20085 trace_id=174 func=iprope_dnat_tree_check line=827 msg="len=0"
id=20085 trace_id=174 func=iprope_dnat_check line=5348 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
id=20085 trace_id=174 func=vf_ip_route_input_common line=2611 msg="find a route: flag=00000000 gw-192.168.56.2 via port6"
id=20085 trace_id=175 func=print_pkt_detail line=5867 msg="vd-root:0 received a packet(proto=17, 10.133.100.200:59286->8.8.8.8:53) tun_id=0.0.0.0 from port1. "
id=20085 trace_id=175 func=init_ip_session_common line=6046 msg="allocate a new session-000046e3, tun_id=0.0.0.0"
id=20085 trace_id=175 func=iprope_dnat_check line=5336 msg="in-[port1], out-[]"
id=20085 trace_id=175 func=iprope_dnat_tree_check line=827 msg="len=0"
id=20085 trace_id=175 func=iprope_dnat_check line=5348 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
id=20085 trace_id=175 func=vf_ip_route_input_common line=2611 msg="find a route: flag=00000000 gw-192.168.56.2 via port6"
id=20085 trace_id=176 func=print_pkt_detail line=5867 msg="vd-root:0 received a packet(proto=17, 10.133.100.200:57329->8.8.8.8:53) tun_id=0.0.0.0 from port1. "
id=20085 trace_id=176 func=init_ip_session_common line=6046 msg="allocate a new session-000046e7, tun_id=0.0.0.0"
id=20085 trace_id=176 func=iprope_dnat_check line=5336 msg="in-[port1], out-[]"
id=20085 trace_id=176 func=iprope_dnat_tree_check line=827 msg="len=0"
id=20085 trace_id=176 func=iprope_dnat_check line=5348 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
id=20085 trace_id=176 func=vf_ip_route_input_common line=2611 msg="find a route: flag=00000000 gw-192.168.56.2 via port6"
id=20085 trace_id=177 func=print_pkt_detail line=5867 msg="vd-root:0 received a packet(proto=17, 10.133.100.200:59286->8.8.8.8:53) tun_id=0.0.0.0 from port1. "
id=20085 trace_id=177 func=init_ip_session_common line=6046 msg="allocate a new session-000046e9, tun_id=0.0.0.0"
id=20085 trace_id=177 func=iprope_dnat_check line=5336 msg="in-[port1], out-[]"
id=20085 trace_id=177 func=iprope_dnat_tree_check line=827 msg="len=0"
id=20085 trace_id=177 func=iprope_dnat_check line=5348 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
id=20085 trace_id=177 func=vf_ip_route_input_common line=2611 msg="find a route: flag=00000000 gw-192.168.56.2 via port6"
id=20085 trace_id=178 func=print_pkt_detail line=5867 msg="vd-root:0 received a packet(proto=17, 10.133.100.200:57329->8.8.8.8:53) tun_id=0.0.0.0 from port1. "
id=20085 trace_id=178 func=init_ip_session_common line=6046 msg="allocate a new session-000046eb, tun_id=0.0.0.0"
id=20085 trace_id=178 func=iprope_dnat_check line=5336 msg="in-[port1], out-[]"
id=20085 trace_id=178 func=iprope_dnat_tree_check line=827 msg="len=0"
id=20085 trace_id=178 func=iprope_dnat_check line=5348 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
id=20085 trace_id=178 func=vf_ip_route_input_common line=2611 msg="find a route: flag=00000000 gw-192.168.56.2 via port6"

[fricci_FTNT]

Hi @producttechlab ,

From the packet capture you posted we see requests but do not see replies.

1.\ Could you run a packet capture on the gateway device 192.168.56.2 or better on the switch connected between the FortiGate and your gateway 192.168.56.2, please.

2.\ Which FOS version are you running?

# get sys status

3.\ If your FortiGate is a physical appliance (no VM), could you try to run the pcap below, please, then ping/DNS from client and ping/traceroute from FortiGate (from a second SSH shell):
diag sniffer packet sw:port6 "host 10.133.100.200 and (host 8.8.8.8 or host 192.168.56.2)" 4 0 l

If you are running FOS 7.2.x or 7.4.x please use:

diag span-sniffer packet sw:port6 "host 10.133.100.200 and (host 8.8.8.8 or host 192.168.56.2)" 4 0 l

It might be better to open a case with Fortinet https://support.fortinet.com or https://www.fortinet.com/support/contact to proceed further.

Best regards,