[style="vertical-align: inherit;"][style="vertical-align: inherit;"]Caro, [/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]tenho o seguinte problema. [/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]Configure a conexão VPN site a site com dois fortigate HQ FG 80E e Branch 60E. [/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]A VPN funciona perfeitamente, as máquinas de ambos os lados se comunicam com sucesso. [/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]Porém, as caixas Fortigate não respondem ao ping em si no modo CLI, eu executo o comando em ambas as caixas com "execute ping + ip".[/style][/style]
[style="vertical-align: inherit;"][style="vertical-align: inherit;"]Mostra a mensagem[/style][/style]
[style="vertical-align: inherit;"][style="vertical-align: inherit;"]FILIAL # executa ping 192.168.254.99 <- IP HQ FG 80E [/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]PING 192.168.254.99 (192.168.254.99): 56 bytes de dados[/style][/style]
[style="vertical-align: inherit;"][style="vertical-align: inherit;"]--- 192.168.254.99 estatísticas de ping --- [/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]5 pacotes transmitidos, 0 pacotes recebidos, 100% de perda de pacotes[/style][/style]
[style="vertical-align: inherit;"][style="vertical-align: inherit;"]HQ # execute ping 192.168.247.99 <- IP FILIAL FG 60E [/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]PING 192.168.247.99 (192.168.247.99): 56 bytes de dados[/style][/style]
[style="vertical-align: inherit;"][style="vertical-align: inherit;"]--- 192.168.247.99 estatísticas de ping --- [/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]5 pacotes transmitidos, 0 pacotes recebidos, 100% de perda de pacotes[/style][/style]
[style="vertical-align: inherit;"][style="vertical-align: inherit;"] thanks for the help[/style][/style]
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Ola
como v.c vai?
Desculpe meu portugues esta mal
Silvia você precisa habilitar permitira ping de acesso na gui pela interface ou via cli
por exemplo
config sys interface edit lan set allowaccess ssh https ping end
Você pode verificar e adicional ping?
Ken Felix
PCNSE
NSE
StrongSwan
Ola
como v.c vai?
Desculpe meu portugues esta mal
Silvia você precisa habilitar permitira ping de acesso na gui pela interface ou via cli
por exemplo
config sys interface edit lan set allowaccess ssh https ping end
Você pode verificar e adicional ping?
Ken Felix
PCNSE
NSE
StrongSwan
Hello Ken Felix
Thanks for your tip, but your suggestion will not work, as I am pinging between two fortigate connected with VPN. That is, I am pinging from gateway to gateway. For example:
HQ IP WAN 200.189.180.157/28 Tunel HQ 0.0.0.0/0.0.00 LAN 192.168.254.99/24 allowaccess ssh https ping
HQ# execute ping 192.168.247.99 FG BRANCH PING 192.168.247.99 (192.168.247.99): 56 data bytes
--- 192.168.247.99 ping statistics --- 5 packets transmitted, 0 packets received, 100% packet loss
-------------------------------------------------- -------------------------------------------------- ----
BRANCH WAN 179.178.158.144/28 TUNEL BRANCH 0.0.0.0/0.0.0.0 LAN 192.168.247.99/24 allowaccess ssh https ping
BRANCH# execute ping 192.168.254.99 PING 192.168.247.99 (192.168.254.99): 56 data bytes
--- 192.168.254.99 ping statistics --- 5 packets transmitted, 0 packets received, 100% packet loss
Okay that is easy, do a diag sniffer packet any "host 192.168.247.99 and icmp " 4
What interface do you see the pings going out of when you do the ping from HQ ? what source address? It's probably the WAN. If you have ipsec-interfaces ip address and maybe if you source from LAN address the traffic might or should go out of the ipsec interface. Do the above and paste the output of the sniffer here for analysis.
Ken Felix
PCNSE
NSE
StrongSwan
hello Ken Felix
Follows the result of the diag
HQ # diagnose sniffer packet any "host 192.168.247.99 and icmp" 4 interfaces = [any] filters = [host 192.168.247.99 and icmp] 3.968859 FG-BH-MATRIZ-HQ out -> 192.168.247.99: icmp: echo request 4.979935 HQ-BRANCH out 200.189.180.157 -> 192.168.247.99: icmp: echo request 5.989927 HQ-BRANCH out 200.189.180.157 -> 192.168.247.99: icmp: echo request 6.999936 HQ-BRANCH out 200.189.180.157 -> 192.168.247.99: icmp: echo request 8.009931 HQ-BRANCH out 200.189.180.157 -> 192.168.247.99: icmp: echo request
5 packets received by filter 0 packets dropped by kernel
This result indicates that the ping icmp traffic is exited through the WAN instead of exiting the tunnel.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1640 | |
1069 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.