no hop recieve

[hbuenafe81]

Hi,

Can someone help me on this? my server reach gw, traceroute result not showing any hops.. Policy is open to all

note: Server (10.3.131.150) is directly connected to FW with int ip 10.3.131.1

PS C:\Users\Administrator> ping 10.2.203.10

Pinging 10.2.203.10 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 10.2.203.10:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
PS C:\Users\Administrator> tracert 10.2.203.10

Tracing route to 10.2.203.10 over a maximum of 30 hops

1 * * * Request timed out.
2 * * * Request timed out.
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.
11 * * * Request timed out.
12 * * * Request timed out.
13 * * * Request timed out.
14 * * * Request timed out.
15 * * * Request timed out.
16 * * * Request timed out.
17 * * * Request timed out.
18 * * * Request timed out.
19 * * * Request timed out.

----firewall---

fwmalaz # execute ping-options source 10.3.131.1

fwmalaz # execute ping 10.2.203.10
PING 10.2.203.10 (10.2.203.10): 56 data bytes
64 bytes from 10.2.203.10: icmp_seq=0 ttl=255 time=0.3 ms
64 bytes from 10.2.203.10: icmp_seq=1 ttl=255 time=0.1 ms
64 bytes from 10.2.203.10: icmp_seq=2 ttl=255 time=0.1 ms
64 bytes from 10.2.203.10: icmp_seq=3 ttl=255 time=0.1 ms
64 bytes from 10.2.203.10: icmp_seq=4 ttl=255 time=0.1 ms

--- 10.2.203.10 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 0.1/0.1/0.3 ms

[hbuenafe81]

Hi, 

edit 26
set name "dmz_ser"
set uuid f809eafa-77ce-51ee-dab6-501fdc9dfb27
set srcintf "port4"
set dstintf "port1"
set action accept
set srcaddr "dmz-server" -- 10.3.131.150
set dstaddr "all"
set schedule "always"
set service "ALL"
set logtraffic all

-----

edit 28
set name "101-dmz"
set uuid 1c5bcb92-6c0a-51ee-1b60-62d3263302e0
set srcintf "port1"
set dstintf "port4"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
set logtraffic all

[syordanov]

Hello,

Please check FW policy 26, there the source is dmz-server with IP address 10.3.131.150 , but if you check the sniffer, the source is 10.3.131.150 and destination is 10.2.203.10 . Try to swap the source/destination on policy 26.

Best regards,

Fortinet

[hbuenafe81]

Hi Bro,

i already try to make this all for source and dst before but no luck. as suggested i make it all now and i will also try to swap it.

edit 26
set name "dmz_ser"
set uuid f809eafa-77ce-51ee-dab6-501fdc9dfb27
set srcintf "port4"
set dstintf "port1"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
set logtraffic all
next

[hbuenafe81]

Hello,

The weird thing is that why server 10.3.131.150 is not able to reach 10.3.131.1 on traceroute. as show below hop.

PS C:\Users\Administrator> tracert 10.2.203.10

Tracing route to 10.2.203.10 over a maximum of 30 hops

1 * * * Request timed out.
2 * * * Request timed out.
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.
11 * * * Request timed out.
12 * * * Request timed out.

[srajeswaran]

Is ping service enabled on the Firewall interface, if not can you enable it and test again?

[hbuenafe81]

Yes, ping is enable.. and to give further history on this.. it was working perfectly for week but suddenly start acting this way. just started yesterday so idk if this is a bug or something. Weird thing is that its not provided next hop even 1st hop 0 respond. 1st hop  suppose to be gw.

[srajeswaran]

Can you confirm the FortiOS version? We may be hitting

https://docs.fortinet.com/document/fortigate/7.0.8/fortios-release-notes/289806/resolved-issues

830823	Traffic is dropped intermittently by the implicit deny policy, even though there is a valid policy on the FortiGate.
832217	Traffic is hitting the implicit deny policy when changes are made to a policy.

[hbuenafe81]

Hi,

thanks for the info, i'll check on this. my fw version 7.0.13

[srajeswaran]

7.0.13 is not affected by these bugs, so it must be something else.

[hbuenafe81]

Dears,

Your help on this is highly appreciated.