routing between two subnets/ unable to connect to devices( printer/NAS)

[antoniocerasuolo]

hi,

I have two subnets :

wifi 10.8.8.0/24

internal 172.22.2.0/24 ( NAS,Printer)

I have created policies to route from wifi->internal and internal ->wifi, I am able to ping the NAS  and Printer from the wifi network but am unable to access the actual devices. in the policies in the source and destination i used the actual subnets and not the usual "all" for the policies, is this correct? I had also tried with all but didn't seem to work either so the issue must be something else...

I am able to access the fortigate admin on the internal from the wifi subnet but that seems to be about all i am able to do..

any idea how to get the visibility of the devices?

ciao,

Antonio

[AEK]

Ciao Altonio

If you are able to ping but not able to access the services (NFS/CIF & print service) then it seems allowed Ping/ICMP but probably you didn't allow the required services.

Try check which port numbers are used by your services then add them to the "Service" field in your firewall rule.

[kwcheng__FTNT]

Since you are able to reach to the FortiGate GUI interface and non other device than that which is within this subnet, why not SNAT your source IP to the FortiGate IP (the one which is the same subnet with other device) and check your connection again. This method basically narrow down the problem to determine whether this is a L3 or L2 related issues.

[dingjerry_FTNT]

Hi @antoniocerasuolo ,

Your description is not clear.

1) "I am able to ping the NAS  and Printer from the wifi network but am unable to access the actual devices."

This means the firewall policy is working at least for ICMP/Ping.

For access the actual devices, what service do you need?  In other words, what port do you need to access?

And you need to share all settings with the firewall policy, including source/destination addresses, if you applied a specific Service object, share it.

2) "I am able to access the fortigate admin on the internal from the wifi subnet but that seems to be about all i am able to do.."

Totally don't understand what you are talking about with the statement.

[dingjerry_FTNT]

@antoniocerasuolo , forgot to ask you:

I assume that you refer to the NAS, Printer for the actual devices.  Do they know how to reply to 10.8.8.0/24 subnet?

[antoniocerasuolo]

in the wifi-> internal & internal->wifi policies i created the service with the ip addressand the presumed ports for the devices i got from looking at the internal logs, but still doesnt work

[antoniocerasuolo]

Hi,

I managed to solve the problem was a question of making sure i'm capturing all the tcp ports correctly and was also a DNS issue on my pc so just used the ip of ther NAS for example \\172.22.2.12 and I was ablew to ac cess correctly!!!

same thing with the printer just needed to make sure i was capturing all the correct tcp ports.

[antoniocerasuolo]

I spoke too soon!!!

something strange is happening, I am able to access the printer correctly from my ROG laptop but not from my DELL, must be something with the DELL laptop?

[dingjerry_FTNT]

Hi @antoniocerasuolo ,

In this case, what you can do:

1) In the firewall policy for "wifi to internal", apply the "ALL" service object.

2) I hope that this firewall policy does not have NAT enabled;

3) You may run the following CLI command:

diag sniffer packet any 'host x.x.x.x and host y.y.y.y' 4   

In this command, x.x.x.x and y.y.y.y are the IPs for the Dell Laptop and the Printer server. 

Then try to access the Printer from your Dell laptop again.  You will see all ports you need to access and you can also see the traffic from the Dell laptop to the Printer.

I am pretty sure that with the "ALL" Service object, it will work for you. But the sniffer command is to help you find out all the ports you need for accessing the Printer.

Then you may apply the specific Service object(s) instead of the "All" Service object.

[antoniocerasuolo]

hi, Yes i see all the traffic passing but its not working. the ROG hits the printer policy  but the DELL hits only the ALL policy!!! very strange, i can see in the forward logs this behaiour!!