second IP on internal interface - problem

[kcerb]

Hello, I added second IP address on internal interface (FortiGate 100A). I have also enabled Administrative Access - PING. The main IP address on this interface is 10.0.0.1/24 The second IP address on this interface is now 192.168.0.1/24 On Windows client PC I have main IP address: 10.0.0.23. Now I added additional IP address: 192.168.0.23 on network card properties. Why can`t I ping to 192.168.0.1 ? I have also other PC`s with 192.168.0.x addresses and I can ping to them.

[UkWizard]

do you have any policy routes defined? what static routes do you have? do you have any other interfaces configured, and if so, whats their IP?

[rwpatterson]

I have seen times where you cannot ping to secondary interfaces on the FGT. I would discount that as a ' problem' . Also if you wish to have one subnet see the other with single IP addresses (on the work stations), you need to create a policy on the FGT like stated above, because the FGT must permit the traffic to cross via a policy.

[UkWizard]

Works okay on a test box here, and its running unpatched mr6 (660 build). What version are you running?

[kcerb]

Thanks everyone for Your time. UkWizard, I`m answering for Your questions: because I have two internet providers, I have two WAN interfaces enabled and I have link redundancy and load sharing. In Router I have two static routes (for WAN1 and WAN2) with the same distance.

 IP/Mask Gateway Device Distance 
 0.0.0.0/0.0.0.0 A1.B1.C1.D1 wan1 10     
 0.0.0.0/0.0.0.0 A2.B2.C2.D2 wan2 10     
 

I have also one policy route to make WAN1 as preferred link:

 Incoming Outgoing Source Destination 
 internal wan1 0.0.0.0 / 0.0.0.0 0.0.0.0 / 0.0.0.0 
 

I have doubled firewall policy internal -> wan1 and internal ->wan2 I have set ping servers to check if link is alive. Everything works fine but second internal IP doesn' t work. My firmware is: 3.00-b0670(MR6 Patch 3) Earlier it was 3.00-b0668 and there was the same problem. rwpatterson, all I want is to have two subnets with one device as internet gate. I do not want to see computers from one subnet to another. I only want to FortiGae act with two internal IP addresses and allow traffic from both subnets to internet.

[UkWizard]

i bet its the policy route breaking this, whether its by design or a bug. Just as a quick test to eliminate it, take the policy route out temporarily and retest. You will need the INT to INT policy as well to allow the routing. if it works without that policy route, try changing the source subnet for it as the main internal IP subnet, rather than 0.0.0.0 and then retest.

[kcerb]

ok. I deleted policy route and I deleted second static route (for additional internet provider). I also disabled all firewall rules except one. The state is now: FG internal primary IP: 10.0.0.1/24 (ping enabled) FG internal secondary IP: 192.168.0.1/24 (ping enabled) One static route:

 IP/Mask Gateway Device Distance
 0.0.0.0/0.0.0.0 A.B.C.D2 wan1 10 
 

No polisy routes. One firewall policy:

 internal -> wan1
 ID  Source  Destination  Schedule  Service  Profile  Action 
 1 all  all  always ANY    ACCEPT 
 

In routing monitor I see:

 Type Subtype Network Distance Metric Gateway Interface 
 Static   0.0.0.0/0 10 0 A.B.C.D2 wan1   
 Connected   10.0.0.0/24 0 0 0.0.0.0 internal   
 Connected   A.B.C.D1/29 0 0 0.0.0.0 wan1   
 Connected   192.168.0.0/24 0 0 0.0.0.0 internal 
 

WAN2 interface is now disabled. I rebooted FortiGate. Form my primary subnet (my PC have only one IP address: 10.0.0.x and 10.0.0.1 as default gateway) I can accesss to internet. I can ping to FG using 10.0.0.1 an I can ping to FG using 192.168.0.1 too! From test computer (with only one IP address 192.168.0.x with 192.168.0.1 as default gateway) a can`t ping to 192.168.0.1 and I can`t go to the internet. I try with overlap enabled and disabled and always nothing.

[UkWizard]

try your pc with just the one static IP 192.168.0.x and see if that works. This is getting odder by the second, this could be a switch problem, do you have any vlans, trunks or managed switches? or any routers within the infrastructure?

[kcerb]

From test computer (with only one IP address 192.168.0.x with 192.168.0.1 as default gateway) ...

I just made simple test: I connected notebook with manualy set one IP address (192.168.0.x) straight to FG (other internal port) and it`s the same situation. I should have allow-overlap enabled or disabled?

[rwpatterson]

Overlap only matters when you wish to have two interfaces share the same IP range. That does not apply here. Treat both networks as independent. The 10.0.0.x works, now forget it! Work on the 192.168.0.x network. Define the default gateway, and then the rule to permit traffic, etc. Even though they are on the same wire, they won' t talk without an explicit FGT rule allowing it (except for that funky PC with two IP addresses). I think you are confusing yourself.

[kcerb]

I solved the problem. 1. I could not execute PING from 192.168.0.x subnet to second FG IP address because in Trusted Hosts (administrator settings) I had only 10.0.0.0/24. Because PING is treated as administrative access, it acted only with subnet 10.0.0.0/24. 2. Internet connection from net 192.168.0. x did not act because I didn' t have DNS server in this subnet (I forgot about this). I also didn' t have enabled " Enable DNS forwarding from: internal" option in Networking options. I' m very grateful for Your help, thank you very much.