What am I missing here?

[Jeff_the_Network_Guy]

I am trying to access a machine that is plugged into Port 6 of my 300C (5.0.7) from a Lan Aggregate port setup. For the life of me I cannot figure out why it isn' t working. I have the policy to allow traffic from the Lann Agg to Port 6, and a policy route so the traffic know where to go. When I try to connect nothing happens and the debug flow looks like this: ADFG16 # id=13 trace_id=468 msg=" vd-root received a packet(proto=17, 10.1.10.106:138->10.1.10.255:138) from port6." id=13 trace_id=468 msg=" allocate a new session-016914b0" id=13 trace_id=468 msg=" find a route: gw-10.1.10.255 via root" id=13 trace_id=468 msg=" iprope_in_check() check failed, drop" id=13 trace_id=469 msg=" vd-root received a packet(proto=1, 192.168.0.241:2->10.1.10.106:8) from LAN_Aggr." id=13 trace_id=469 msg=" allocate a new session-01691627" id=13 trace_id=469 msg=" Match policy routing: to 10.1.10.1 via ifindex-5" id=13 trace_id=469 msg=" find a route: gw-10.1.10.1 via root" id=13 trace_id=469 msg=" iprope_in_check() check failed, drop" id=13 trace_id=470 msg=" vd-root received a packet(proto=1, 192.168.0.241:2->10.1.10.106:8) from LAN_Aggr." id=13 trace_id=470 msg=" allocate a new session-016916d1" id=13 trace_id=470 msg=" Match policy routing: to 10.1.10.1 via ifindex-5" id=13 trace_id=470 msg=" find a route: gw-10.1.10.1 via root" id=13 trace_id=470 msg=" iprope_in_check() check failed, drop" id=13 trace_id=471 msg=" vd-root received a packet(proto=1, 192.168.0.241:2->10.1.10.106:8) from LAN_Aggr." id=13 trace_id=471 msg=" allocate a new session-01691730" id=13 trace_id=471 msg=" Match policy routing: to 10.1.10.1 via ifindex-5" id=13 trace_id=471 msg=" find a route: gw-10.1.10.1 via root" id=13 trace_id=471 msg=" iprope_in_check() check failed, drop" id=13 trace_id=472 msg=" vd-root received a packet(proto=1, 192.168.0.241:2->10.1.10.106:8) from LAN_Aggr." id=13 trace_id=472 msg=" allocate a new session-016917f6" id=13 trace_id=472 msg=" Match policy routing: to 10.1.10.1 via ifindex-5" id=13 trace_id=472 msg=" find a route: gw-10.1.10.1 via root" id=13 trace_id=472 msg=" iprope_in_check() check failed, drop" id=13 trace_id=473 msg=" vd-root received a packet(proto=6, 192.168.0.241:53396->10.1.10.106:3389) from LAN_Aggr." id=13 trace_id=473 msg=" allocate a new session-01692af5" id=13 trace_id=473 msg=" Match policy routing: to 10.1.10.1 via ifindex-5" id=13 trace_id=473 msg=" find a route: gw-10.1.10.1 via root" id=13 trace_id=473 msg=" iprope_in_check() check failed, drop" id=13 trace_id=474 msg=" vd-root received a packet(proto=6, 192.168.0.241:53396->10.1.10.106:3389) from LAN_Aggr." id=13 trace_id=474 msg=" allocate a new session-01692b61" id=13 trace_id=474 msg=" Match policy routing: to 10.1.10.1 via ifindex-5" id=13 trace_id=474 msg=" find a route: gw-10.1.10.1 via root" id=13 trace_id=474 msg=" iprope_in_check() check failed, drop" id=13 trace_id=475 msg=" vd-root received a packet(proto=6, 192.168.0.241:53396->10.1.10.106:3389) from LAN_Aggr." id=13 trace_id=475 msg=" allocate a new session-01692c01" id=13 trace_id=475 msg=" Match policy routing: to 10.1.10.1 via ifindex-5" id=13 trace_id=475 msg=" find a route: gw-10.1.10.1 via root" id=13 trace_id=475 msg=" iprope_in_check() check failed, drop" This is got to be something simple, but after hours of staring I' m just going cross-eyed.

[emnoc]

Once again, do you have a fwpolicy for traffic from the LAN_agr network & to the Port6? That before trace shows traffic SNAT and sent out of port1 . I' m assuming Port1 is your wan-uplink.

[Jeff_the_Network_Guy]

ADFG16 (policy) # edit 44 ADFG16 (44) # show config firewall policy edit 44 set srcintf " LAN_Aggr" set dstintf " port6" set srcaddr " LAN_HQ" set dstaddr " STM" set action accept set schedule " always" set service " ALL" set logtraffic all next end ADFG16 (44) # LAN_HQ is 192.168.0.0/255.255.252.0 STM is 10.1.10.0/255.255.255.0 It is essentially like the Fortigate is not routing or not aware of its own interfaces.

[emnoc]

Things to look at? Does the host seems ping from the firewall directly? Is the netmask correct on the host ? is the service enabled on that host ? Does diag debug flow show you matching fwpolicy id #44 now? Do you have any other fwpolicies ahead of it that might be blocking? Have you tried to move the fwpolicy id #44 ahead of everything else? fwiw: if the network is directly connected, than the firewall knows about that network

[netmin]

... and take a look at policy route #3 - it is forcing part (/24) of the LAN_HQ traffic out to port1 - including the IP .241

[Jeff_the_Network_Guy]

Netmin: You' re right about policy route three, it is intentional. We want all undefined traffic from 192.168.0.0 to go out one WAN, and all traffic from 192.168.[1-3].0 to got out a different WAN connection.

[netmin]

Jeff, pbr #3 is the reason your all your traffic intended for port6 is snat' d to an external ip on port1 instead of being routed to port6. It looks like port1 is your default route candidate, so pbr #3 should not be required. In your previous configuration, pbr #23 took precedence over pbr #3. However in pbr #23 you specified 10.1.10.1 as next hop gateway (outside the fortigate), but actually 10.1.10.1 appears to be the interface ip of port6, hence the iprope_in_check message - like an attempt to force the fortigate to be it' s own next hop gateway. Without pbr #3 and without pbr #23 it should be working fine - with correct firewall policies in place.

[Jeff_the_Network_Guy]

Gah! You' re right Netmin. I removed the two PBRs (#3 & #23) and it all started working. I was trying to get too cute. I had too many PBRs because I was trying to make sure certain traffic went to certain WAN interfaces without thinking about my default route.