routing between two subnets/ unable to connect to devices( printer/NAS)

[antoniocerasuolo]

hi,

I have two subnets :

wifi 10.8.8.0/24

internal 172.22.2.0/24 ( NAS,Printer)

I have created policies to route from wifi->internal and internal ->wifi, I am able to ping the NAS  and Printer from the wifi network but am unable to access the actual devices. in the policies in the source and destination i used the actual subnets and not the usual "all" for the policies, is this correct? I had also tried with all but didn't seem to work either so the issue must be something else...

I am able to access the fortigate admin on the internal from the wifi subnet but that seems to be about all i am able to do..

any idea how to get the visibility of the devices?

ciao,

Antonio

[antoniocerasuolo]

diag sniffer packet any 'host 10.8.8.11 and host 172.22.2.11' 4 

FortiWiFi-40F # diag sniffer packet any 'host 10.8.8.11 and host 172.22.2.11' 4 
interfaces=[any]
filters=[host 10.8.8.11 and host 172.22.2.11]
0.371740 lan in 172.22.2.11.443 -> 10.8.8.11.8565: psh 2674544269 ack 858659857 
0.371753 internal in 172.22.2.11.443 -> 10.8.8.11.8565: psh 2674544269 ack 858659857 
0.371793 guestwifi out 172.22.2.11.443 -> 10.8.8.11.8565: psh 2674544269 ack 858659857 
0.371804 __xxwlan01 out 172.22.2.11.443 -> 10.8.8.11.8565: psh 2674544269 ack 858659857 
0.373102 guestwifi in 10.8.8.11.8565 -> 172.22.2.11.443: ack 2674544866 
0.373121 internal out 10.8.8.11.8565 -> 172.22.2.11.443: ack 2674544866 
0.373129 lan out 10.8.8.11.8565 -> 172.22.2.11.443: ack 2674544866 
0.408904 guestwifi in 10.8.8.11.8558 -> 172.22.2.11.443: fin 2835426655 ack 908127551 
0.408922 internal out 10.8.8.11.8558 -> 172.22.2.11.443: fin 2835426655 ack 908127551 
0.408927 lan out 10.8.8.11.8558 -> 172.22.2.11.443: fin 2835426655 ack 908127551 
0.410561 guestwifi in 10.8.8.11.8567 -> 172.22.2.11.443: syn 952355301 
0.410594 lan in 172.22.2.11.443 -> 10.8.8.11.8558: fin 908127551 ack 2835426656 
0.410598 internal in 172.22.2.11.443 -> 10.8.8.11.8558: fin 908127551 ack 2835426656 
0.410616 guestwifi out 172.22.2.11.443 -> 10.8.8.11.8558: fin 908127551 ack 2835426656 
0.410622 __xxwlan01 out 172.22.2.11.443 -> 10.8.8.11.8558: fin 908127551 ack 2835426656 
0.410683 internal out 10.8.8.11.8567 -> 172.22.2.11.443: syn 952355301 
0.410688 lan out 10.8.8.11.8567 -> 172.22.2.11.443: syn 952355301 
0.411414 lan in 172.22.2.11.443 -> 10.8.8.11.8567: syn 689116765 ack 952355302 
0.411419 internal in 172.22.2.11.443 -> 10.8.8.11.8567: syn 689116765 ack 952355302 
0.411446 guestwifi out 172.22.2.11.443 -> 10.8.8.11.8567: syn 689116765 ack 952355302 
0.411452 __xxwlan01 out 172.22.2.11.443 -> 10.8.8.11.8567: syn 689116765 ack 952355302 
0.412054 guestwifi in 10.8.8.11.8558 -> 172.22.2.11.443: ack 908127551 
0.412069 internal out 10.8.8.11.8558 -> 172.22.2.11.443: ack 908127551 
0.412074 lan out 10.8.8.11.8558 -> 172.22.2.11.443: ack 908127551 
0.412422 guestwifi in 10.8.8.11.8558 -> 172.22.2.11.443: ack 908127552 
0.412435 internal out 10.8.8.11.8558 -> 172.22.2.11.443: ack 908127552 
0.412440 lan out 10.8.8.11.8558 -> 172.22.2.11.443: ack 908127552 
0.413126 guestwifi in 10.8.8.11.8567 -> 172.22.2.11.443: ack 689116766 
0.413145 internal out 10.8.8.11.8567 -> 172.22.2.11.443: ack 689116766 
0.413149 lan out 10.8.8.11.8567 -> 172.22.2.11.443: ack 689116766 
0.414088 guestwifi in 10.8.8.11.8567 -> 172.22.2.11.443: psh 952355302 ack 689116766 
0.414106 internal out 10.8.8.11.8567 -> 172.22.2.11.443: psh 952355302 ack 689116766 
0.414111 lan out 10.8.8.11.8567 -> 172.22.2.11.443: psh 952355302 ack 689116766 
0.414620 lan in 172.22.2.11.443 -> 10.8.8.11.8567: ack 952355634 
0.414625 internal in 172.22.2.11.443 -> 10.8.8.11.8567: ack 952355634 
0.414643 guestwifi out 172.22.2.11.443 -> 10.8.8.11.8567: ack 952355634 
0.414648 __xxwlan01 out 172.22.2.11.443 -> 10.8.8.11.8567: ack 952355634 
0.424103 lan in 172.22.2.11.443 -> 10.8.8.11.8567: psh 689116766 ack 952355634 
0.424107 internal in 172.22.2.11.443 -> 10.8.8.11.8567: psh 689116766 ack 952355634 
0.424124 guestwifi out 172.22.2.11.443 -> 10.8.8.11.8567: psh 689116766 ack 952355634 
0.424128 __xxwlan01 out 172.22.2.11.443 -> 10.8.8.11.8567: psh 689116766 ack 952355634 
0.425465 guestwifi in 10.8.8.11.8567 -> 172.22.2.11.443: ack 689116899 
0.425483 internal out 10.8.8.11.8567 -> 172.22.2.11.443: ack 689116899 
0.425488 lan out 10.8.8.11.8567 -> 172.22.2.11.443: ack 689116899 
0.429549 guestwifi in 10.8.8.11.8567 -> 172.22.2.11.443: fin 952355634 ack 689116899 
0.429563 internal out 10.8.8.11.8567 -> 172.22.2.11.443: fin 952355634 ack 689116899 
0.429567 lan out 10.8.8.11.8567 -> 172.22.2.11.443: fin 952355634 ack 689116899 
0.431272 lan in 172.22.2.11.443 -> 10.8.8.11.8567: fin 689116899 ack 952355635 
0.431277 internal in 172.22.2.11.443 -> 10.8.8.11.8567: fin 689116899 ack 952355635 
0.431290 guestwifi out 172.22.2.11.443 -> 10.8.8.11.8567: fin 689116899 ack 952355635 
0.431294 __xxwlan01 out 172.22.2.11.443 -> 10.8.8.11.8567: fin 689116899 ack 952355635 
0.431927 guestwifi in 10.8.8.11.8568 -> 172.22.2.11.443: syn 3718338557 
0.431982 internal out 10.8.8.11.8568 -> 172.22.2.11.443: syn 3718338557 
0.431988 lan out 10.8.8.11.8568 -> 172.22.2.11.443: syn 3718338557 
0.432638 lan in 172.22.2.11.443 -> 10.8.8.11.8568: syn 1176467367 ack 3718338558 
0.432643 internal in 172.22.2.11.443 -> 10.8.8.11.8568: syn 1176467367 ack 3718338558 
0.432662 guestwifi out 172.22.2.11.443 -> 10.8.8.11.8568: syn 1176467367 ack 3718338558 
0.432666 __xxwlan01 out 172.22.2.11.443 -> 10.8.8.11.8568: syn 1176467367 ack 3718338558 
0.432998 guestwifi in 10.8.8.11.8567 -> 172.22.2.11.443: ack 689116899 
0.433011 internal out 10.8.8.11.8567 -> 172.22.2.11.443: ack 689116899 
0.433016 lan out 10.8.8.11.8567 -> 172.22.2.11.443: ack 689116899 
0.433441 guestwifi in 10.8.8.11.8567 -> 172.22.2.11.443: ack 689116900 
0.433454 internal out 10.8.8.11.8567 -> 172.22.2.11.443: ack 689116900 
0.433459 lan out 10.8.8.11.8567 -> 172.22.2.11.443: ack 689116900 
0.435797 guestwifi in 10.8.8.11.8568 -> 172.22.2.11.443: ack 1176467368 
0.435816 internal out 10.8.8.11.8568 -> 172.22.2.11.443: ack 1176467368 
0.435820 lan out 10.8.8.11.8568 -> 172.22.2.11.443: ack 1176467368 
0.436926 guestwifi in 10.8.8.11.8568 -> 172.22.2.11.443: psh 3718338558 ack 1176467368 
0.436944 internal out 10.8.8.11.8568 -> 172.22.2.11.443: psh 3718338558 ack 1176467368 
0.436949 lan out 10.8.8.11.8568 -> 172.22.2.11.443: psh 3718338558 ack 1176467368 
0.437513 lan in 172.22.2.11.443 -> 10.8.8.11.8568: ack 3718338890 
0.437518 internal in 172.22.2.11.443 -> 10.8.8.11.8568: ack 3718338890 
0.437535 guestwifi out 172.22.2.11.443 -> 10.8.8.11.8568: ack 3718338890 
0.437540 __xxwlan01 out 172.22.2.11.443 -> 10.8.8.11.8568: ack 3718338890 
0.447417 lan in 172.22.2.11.443 -> 10.8.8.11.8568: psh 1176467368 ack 3718338890 
0.447421 internal in 172.22.2.11.443 -> 10.8.8.11.8568: psh 1176467368 ack 3718338890 
0.447438 guestwifi out 172.22.2.11.443 -> 10.8.8.11.8568: psh 1176467368 ack 3718338890 
0.447443 __xxwlan01 out 172.22.2.11.443 -> 10.8.8.11.8568: psh 1176467368 ack 3718338890 
0.448224 guestwifi in 10.8.8.11.8568 -> 172.22.2.11.443: ack 1176467501 
0.448243 internal out 10.8.8.11.8568 -> 172.22.2.11.443: ack 1176467501 
0.448248 lan out 10.8.8.11.8568 -> 172.22.2.11.443: ack 1176467501 
0.451210 guestwifi in 10.8.8.11.8568 -> 172.22.2.11.443: psh 3718338890 ack 1176467501 
0.451223 internal out 10.8.8.11.8568 -> 172.22.2.11.443: psh 3718338890 ack 1176467501 
0.451227 lan out 10.8.8.11.8568 -> 172.22.2.11.443: psh 3718338890 ack 1176467501 
0.452904 guestwifi in 10.8.8.11.8568 -> 172.22.2.11.443: psh 3718338965 ack 1176467501 
0.452917 internal out 10.8.8.11.8568 -> 172.22.2.11.443: psh 3718338965 ack 1176467501 
0.452922 lan out 10.8.8.11.8568 -> 172.22.2.11.443: psh 3718338965 ack 1176467501 
0.455007 lan in 172.22.2.11.443 -> 10.8.8.11.8568: ack 3718339178 
0.455012 internal in 172.22.2.11.443 -> 10.8.8.11.8568: ack 3718339178 
0.455023 guestwifi out 172.22.2.11.443 -> 10.8.8.11.8568: ack 3718339178 
0.455028 __xxwlan01 out 172.22.2.11.443 -> 10.8.8.11.8568: ack 3718339178 
9.711631 lan in 172.22.2.11.443 -> 10.8.8.11.8568: psh 1176467501 ack 3718339178 
9.711639 internal in 172.22.2.11.443 -> 10.8.8.11.8568: psh 1176467501 ack 3718339178 
9.711667 guestwifi out 172.22.2.11.443 -> 10.8.8.11.8568: psh 1176467501 ack 3718339178 
9.711676 __xxwlan01 out 172.22.2.11.443 -> 10.8.8.11.8568: psh 1176467501 ack 3718339178 
9.713533 guestwifi in 10.8.8.11.8568 -> 172.22.2.11.443: ack 1176468098 
9.713552 internal out 10.8.8.11.8568 -> 172.22.2.11.443: ack 1176468098 
9.713558 lan out 10.8.8.11.8568 -> 172.22.2.11.443: ack 1176468098 
9.735547 guestwifi in 10.8.8.11.8565 -> 172.22.2.11.443: fin 858659857 ack 2674544866 
9.735566 internal out 10.8.8.11.8565 -> 172.22.2.11.443: fin 858659857 ack 2674544866 
9.735571 lan out 10.8.8.11.8565 -> 172.22.2.11.443: fin 858659857 ack 2674544866 
9.735578 guestwifi in 10.8.8.11.8569 -> 172.22.2.11.443: syn 1501817383 
9.735683 internal out 10.8.8.11.8569 -> 172.22.2.11.443: syn 1501817383 
9.735688 lan out 10.8.8.11.8569 -> 172.22.2.11.443: syn 1501817383 
9.736598 lan in 172.22.2.11.443 -> 10.8.8.11.8569: syn 1260240102 ack 1501817384 
9.736602 internal in 172.22.2.11.443 -> 10.8.8.11.8569: syn 1260240102 ack 1501817384 
9.736624 guestwifi out 172.22.2.11.443 -> 10.8.8.11.8569: syn 1260240102 ack 1501817384 
9.736629 __xxwlan01 out 172.22.2.11.443 -> 10.8.8.11.8569: syn 1260240102 ack 1501817384 
9.738016 lan in 172.22.2.11.443 -> 10.8.8.11.8565: fin 2674544866 ack 858659858 
9.738020 internal in 172.22.2.11.443 -> 10.8.8.11.8565: fin 2674544866 ack 858659858 
9.738033 guestwifi out 172.22.2.11.443 -> 10.8.8.11.8565: fin 2674544866 ack 858659858 
9.738037 __xxwlan01 out 172.22.2.11.443 -> 10.8.8.11.8565: fin 2674544866 ack 858659858 
9.739097 guestwifi in 10.8.8.11.8569 -> 172.22.2.11.443: ack 1260240103 
9.739116 internal out 10.8.8.11.8569 -> 172.22.2.11.443: ack 1260240103 
9.739121 lan out 10.8.8.11.8569 -> 172.22.2.11.443: ack 1260240103 
9.739128 guestwifi in 10.8.8.11.8565 -> 172.22.2.11.443: ack 2674544866 
9.739138 internal out 10.8.8.11.8565 -> 172.22.2.11.443: ack 2674544866 
9.739142 lan out 10.8.8.11.8565 -> 172.22.2.11.443: ack 2674544866 
9.739970 guestwifi in 10.8.8.11.8565 -> 172.22.2.11.443: ack 2674544867 
9.739983 internal out 10.8.8.11.8565 -> 172.22.2.11.443: ack 2674544867 
9.739987 lan out 10.8.8.11.8565 -> 172.22.2.11.443: ack 2674544867 
9.740494 guestwifi in 10.8.8.11.8569 -> 172.22.2.11.443: psh 1501817384 ack 1260240103 
9.740512 internal out 10.8.8.11.8569 -> 172.22.2.11.443: psh 1501817384 ack 1260240103 
9.740516 lan out 10.8.8.11.8569 -> 172.22.2.11.443: psh 1501817384 ack 1260240103 
9.740992 lan in 172.22.2.11.443 -> 10.8.8.11.8569: ack 1501817716 
9.740996 internal in 172.22.2.11.443 -> 10.8.8.11.8569: ack 1501817716 
9.741011 guestwifi out 172.22.2.11.443 -> 10.8.8.11.8569: ack 1501817716 
9.741016 __xxwlan01 out 172.22.2.11.443 -> 10.8.8.11.8569: ack 1501817716 
9.750675 lan in 172.22.2.11.443 -> 10.8.8.11.8569: psh 1260240103 ack 1501817716 
9.750679 internal in 172.22.2.11.443 -> 10.8.8.11.8569: psh 1260240103 ack 1501817716 
9.750695 guestwifi out 172.22.2.11.443 -> 10.8.8.11.8569: psh 1260240103 ack 1501817716 
9.750700 __xxwlan01 out 172.22.2.11.443 -> 10.8.8.11.8569: psh 1260240103 ack 1501817716 
9.752004 guestwifi in 10.8.8.11.8569 -> 172.22.2.11.443: ack 1260240236 
9.752022 internal out 10.8.8.11.8569 -> 172.22.2.11.443: ack 1260240236 
9.752027 lan out 10.8.8.11.8569 -> 172.22.2.11.443: ack 1260240236 
9.754301 guestwifi in 10.8.8.11.8569 -> 172.22.2.11.443: fin 1501817716 ack 1260240236 
9.754315 internal out 10.8.8.11.8569 -> 172.22.2.11.443: fin 1501817716 ack 1260240236 
9.754320 lan out 10.8.8.11.8569 -> 172.22.2.11.443: fin 1501817716 ack 1260240236 
9.755247 guestwifi in 10.8.8.11.8570 -> 172.22.2.11.443: syn 2032481794 
9.755293 internal out 10.8.8.11.8570 -> 172.22.2.11.443: syn 2032481794 
9.755298 lan out 10.8.8.11.8570 -> 172.22.2.11.443: syn 2032481794 
9.756386 lan in 172.22.2.11.443 -> 10.8.8.11.8570: syn 990997043 ack 2032481795 
9.756390 internal in 172.22.2.11.443 -> 10.8.8.11.8570: syn 990997043 ack 2032481795 
9.756409 guestwifi out 172.22.2.11.443 -> 10.8.8.11.8570: syn 990997043 ack 2032481795 
9.756414 __xxwlan01 out 172.22.2.11.443 -> 10.8.8.11.8570: syn 990997043 ack 2032481795 
9.757247 lan in 172.22.2.11.443 -> 10.8.8.11.8569: fin 1260240236 ack 1501817717 
9.757251 internal in 172.22.2.11.443 -> 10.8.8.11.8569: fin 1260240236 ack 1501817717 
9.757263 guestwifi out 172.22.2.11.443 -> 10.8.8.11.8569: fin 1260240236 ack 1501817717 
9.757267 __xxwlan01 out 172.22.2.11.443 -> 10.8.8.11.8569: fin 1260240236 ack 1501817717 
9.757792 guestwifi in 10.8.8.11.8570 -> 172.22.2.11.443: ack 990997044 
9.757810 internal out 10.8.8.11.8570 -> 172.22.2.11.443: ack 990997044 

[dingjerry_FTNT]

For service objects "nas_access_from_guest_wifi" and "printer_access_from_wifi_guest", it's better not to specify the IP range.  What if you change the NAS server IP and / or the Printer IP in the future and you forget this setting here?

[dingjerry_FTNT]

"guest_wifi_to_internal_source"
"guest_wifi_to_internal_dest"
"internal_to_guest_source"
"internal_to_guest_destination"

Those address objects are redundant. Why not just create the objects with the following two?

"guest_wifi" with subnet 10.8.8.0 255.255.255.0
"internal" with subnet 172.22.2.0 255.255.255.0

[antoniocerasuolo]

"guest_wifi_to_internal_source"
"guest_wifi_to_internal_dest"

these here below are no longer in use in any policy or lets say the policy they are bound is inactive:

"internal_to_guest_source"
"internal_to_guest_destination"

[dingjerry_FTNT]

Hi @antoniocerasuolo ,

The current policies #30 & #27 are a shadow of policy 29.  Only if you change the destination address to NAS device and Printer respectively, it will make more sense.  Otherwise, we just need policy #29 enough.

[dingjerry_FTNT]

Hi @antoniocerasuolo ,

I said, to provide relevant configurations.  You provided all the other irrelevant configurations so that's there are a lot of data.

[antoniocerasuolo]

yes but everything is relevant didnt know

[antoniocerasuolo]

do you have a suggestion ?

[dingjerry_FTNT]

No.

1) You provided 3 policies, 27,29 and 30.  That's good.

2) You provided all firewall address objects.  

You may just need to provide 

"guest_wifi_to_internal_source"

"guest_wifi_to_internal_dest"

Suggestion: No matter whether the other 2 address objects are in use or not, better just to use "guest_wifi_subnet" with the Guest WiFi subnet and "internal_subnet" as the internal subnet.  Do not add more words which will confuse you in the future, and will make things complicated for TAC if you need TAC assistance in the future.

3) You provided all Service Objects.

You may just provide the following ones:

"nas_access_from_guest_wifi"

"printer_access_from_wifi_guest"

It's better not to add "_from_guest_wifi" and "_from_wifi_guest".  In the future, if you add more networks, you may also use those objects but will confuse yourself and others.  

Just name them as "Internal_NAS Server" and "Internal_Printer Server" so we know that they are located in the Internal network.

And it's better not to specify the IP range there.  I explained the reason in another reply.

3) Based on the outputs of sniffer packet capture:

9.755298 lan out 10.8.8.11.8570 -> 172.22.2.11.443: syn 2032481794
9.756386 lan in 172.22.2.11.443 -> 10.8.8.11.8570: syn 990997043 ack 2032481795
9.756390 internal in 172.22.2.11.443 -> 10.8.8.11.8570: syn 990997043 ack 2032481795
9.756409 guestwifi out 172.22.2.11.443 -> 10.8.8.11.8570: syn 990997043 ack 2032481795
9.756414 __xxwlan01 out 172.22.2.11.443 -> 10.8.8.11.8570: syn 990997043 ack 2032481795

I assume that 10.8.8.11 is the Dell laptop.  I know that 172.22.2.11 is the Printer.  

Why Dell laptop was accessing the Printer at port 443 and no other ports?

[antoniocerasuolo]

this is a trace with the other computer that is printing fine.

FortiWiFi-40F # diag sniffer packet any 'host 10.8.8.13 and host 172.22.2.11' 4
interfaces=[any]
filters=[host 10.8.8.13 and host 172.22.2.11]
104.940402 guestwifi in 10.8.8.13 -> 172.22.2.11: icmp: echo request
104.940543 internal out 10.8.8.13 -> 172.22.2.11: icmp: echo request
104.940551 lan out 10.8.8.13 -> 172.22.2.11: icmp: echo request
104.941218 lan in 172.22.2.11 -> 10.8.8.13: icmp: echo reply
104.941225 internal in 172.22.2.11 -> 10.8.8.13: icmp: echo reply
104.941256 guestwifi out 172.22.2.11 -> 10.8.8.13: icmp: echo reply
104.941263 __xxwlan01 out 172.22.2.11 -> 10.8.8.13: icmp: echo reply
106.011136 guestwifi in 10.8.8.13 -> 172.22.2.11: icmp: echo request
106.011179 internal out 10.8.8.13 -> 172.22.2.11: icmp: echo request
106.011188 lan out 10.8.8.13 -> 172.22.2.11: icmp: echo request
106.011753 lan in 172.22.2.11 -> 10.8.8.13: icmp: echo reply
106.011760 internal in 172.22.2.11 -> 10.8.8.13: icmp: echo reply
106.011782 guestwifi out 172.22.2.11 -> 10.8.8.13: icmp: echo reply
106.011790 __xxwlan01 out 172.22.2.11 -> 10.8.8.13: icmp: echo reply
127.222464 guestwifi in 10.8.8.13 -> 172.22.2.11: icmp: echo request
127.222503 internal out 10.8.8.13 -> 172.22.2.11: icmp: echo request
127.222513 lan out 10.8.8.13 -> 172.22.2.11: icmp: echo request
127.223166 lan in 172.22.2.11 -> 10.8.8.13: icmp: echo reply
127.223173 internal in 172.22.2.11 -> 10.8.8.13: icmp: echo reply
127.223198 guestwifi out 172.22.2.11 -> 10.8.8.13: icmp: echo reply
127.223205 __xxwlan01 out 172.22.2.11 -> 10.8.8.13: icmp: echo reply
127.230312 guestwifi in 10.8.8.13.59522 -> 172.22.2.11.443: syn 1649016386
127.230423 internal out 10.8.8.13.59522 -> 172.22.2.11.443: syn 1649016386
127.230429 lan out 10.8.8.13.59522 -> 172.22.2.11.443: syn 1649016386
127.231131 lan in 172.22.2.11.443 -> 10.8.8.13.59522: syn 2017441132 ack 1649016387
127.231136 internal in 172.22.2.11.443 -> 10.8.8.13.59522: syn 2017441132 ack 1649016387