fortigate virtual ip cant access from outside

[Zenhusen]

I have replaced the current firewall an old 50E with a new 60F
Sadly we could not use the config file from the old one.

1. I have setup VirtualsIP for our meters(we have meters that collects info for our building)
2. And then i did a virtual IP Group, with all the meters
3. Then i setup Firewall policy

The issue i have is that i cannot access the meters when i am on another network(over internet).

Here is how i have setup the firewall, have i forgotten something. Must say i am not used to work with firewalls at all.

[Zenhusen]

Hi Toshi
I am totally newbie at firewalls

Should i write in cli
get router info routing-t Infometric

Where Infometric is the Policy name

[Toshi_Esumi]

No. Just use the same command line I showed above. Just like most of other routers like Cisco's, if you type '?' when you're not sure the options, the FGT shows you what you can enter.

fg40f-utm (root) # get router info routing-t ?
details        show routing table details information
all                show all routing table entries
rip               show rip routing table
ospf            show ospf routing table
bgp             show bgp routing table
isis              show isis routing table
static          show static routing table
connected show connected routing table
database    show routing information base

Then look for the default route 0.0.0.0/0 and see where it's pointing to. If PPPoE, it would show the virtual interface name like ppp3 created on top of physical interface, which has your public IP pulled over PPPoE.

Toshi

[Zenhusen]

Then i get

FortiGate-60F # get router info routing-t all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
V - BGP VPNv4
* - candidate default

Routing table for VRF=0
S* 0.0.0.0/0 [5/0] via 212.100.125.1, wan1, [1/0]
C 192.168.1.0/24 is directly connected, internal
C 212.100.125.0/24 is directly connected, wan1

[Toshi_Esumi]

Then "wan1" should work with diag sys waninfo ipify.
Are you sure DNS works from the FGT?  You can ping api.ipify.org, right?

fg40f-utm (root) # exe ping api.ipify.org
PING api.ipify.org (104.26.13.205): 56 data bytes
64 bytes from 104.26.13.205: icmp_seq=0 ttl=56 time=15.3 ms
64 bytes from 104.26.13.205: icmp_seq=1 ttl=56 time=15.6 ms
64 bytes from 104.26.13.205: icmp_seq=2 ttl=56 time=14.5 ms
64 bytes from 104.26.13.205: icmp_seq=3 ttl=56 time=14.4 ms
64 bytes from 104.26.13.205: icmp_seq=4 ttl=56 time=16.3 ms

[Zenhusen]

its something with the firewall setting 
It wont connect to internet

did the execute ping api.ipify.org
Unable to resolve hostname.

My IPS said it visible from their side I got an IP nr through DHCP

[funkylicious]

make sure that DNS servers are set similarly to this where it uses 1.1.1.1 and 8.8.8.8,

config system dns
set primary 1.1.1.1
set secondary 8.8.8.8
set protocol cleartext
set ssl-certificate "Fortinet_Factory"
set ip6-primary ::
set ip6-secondary ::
set timeout 5
set retry 2
set dns-cache-limit 5000
set dns-cache-ttl 1800
set cache-notfound-responses disable
set source-ip 0.0.0.0
set interface-select-method auto
set server-select-method least-rtt
set alt-primary 0.0.0.0
set alt-secondary 0.0.0.0
set log disable
set fqdn-cache-ttl 0
set fqdn-max-refresh 3600
set fqdn-min-refresh 60
end

[Zenhusen]

currently it is
show system dns
config system dns
set primary 8.8.8.8
set secondary 1.1.1.1
set protocol dot
set server-hostname "globalsdns.fortinet.net"
end

added this 
set protocol cleartext
set ssl-certificate "Fortinet_Factory"
set ip6-primary ::
set ip6-secondary ::
set timeout 5
set retry 2
set dns-cache-limit 5000
set dns-cache-ttl 1800
set cache-notfound-responses disable
set source-ip 0.0.0.0
set interface-select-method auto
set server-select-method least-rtt
set alt-primary 0.0.0.0
set alt-secondary 0.0.0.0
set log disable
set fqdn-cache-ttl 0
set fqdn-max-refresh 3600
set fqdn-min-refresh 60

Except this that was not accepted
fqdn-max-refresh 3600

[Zenhusen]

after the changes i did
execute ping api.ipify.org
Unable to resolve hostname.

still cant connect

[funkylicious]

can you do a, execute ping 8.8.8.8 and execute traceroute 8.8.8.8 ?

[Zenhusen]

FortiGate-60F # execute ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes

--- 8.8.8.8 ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss

FortiGate-60F # execute traceroute 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 32 hops max, 3 probe packets per hop, 84 byte packets
1 212.100.125.1 2.262 ms 0.629 ms 0.213 ms
2 178.251.129.22 0.238 ms 0.262 ms 0.233 ms
3 * * *
4 89.160.39.203 0.602 ms 0.632 ms 0.560 ms
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *

and it keeps going like that