Zerotier

[AmSteen]

I have zerotier installed and running on server behind fortigate 40E firmware 7.4.5 but it is not reachable from zerotier cloud and from inside it can not ping other pc's on zerotier cloud.

When connect server to internet direct zerotier is working perfect.

So how to know the policy responsible about blocking zerotier traffic ??

Or where to find or identify this blocking in logs ??

[dingjerry_FTNT]

Hi @AmSteen ,

We can use the debug flow commands to find out why the traffic is blocked:

I use this case "from inside it can not ping other pc's on zerotier cloud" as an example. 

Assume you want to Ping 1.1.1.1, the PC on zerotier cloud.

diag debug flow show iprope enable

diag debug flow filter proto 1

diag debug flow filter addr 1.1.1.1

diag debug flow trace start 10

diag debug enable

Then initiate a Ping to reproduce this issue.  Please do not run a continuous Ping.

Please share the outputs here.

[kaman]

Hi AmSteen,

To determine which policy is handling ZeroTier traffic, you can use the Firewall Policy Lookup feature.

Firewall policy lookup is based on the Source_interfaces/Protocol/Source_Address/Destination_Address that matches the source-port and dst-port of the protocol. Use this tool to find out which policy matches specific traffic from a number of policies. After completing the lookup, the matching firewall policy is highlighted on the policy list page.

Please refer to the below document for more information:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Firewall-policy-lookups/ta-p/192912

You can also check the session list with the help of the below commands:

diagnose sys session filter src <source-ip>
diagnose sys session list

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-it-is-possible-to-use-filter-with-diag...

Regards,
Aman