second IP on internal interface - problem

[kcerb]

Hello, I added second IP address on internal interface (FortiGate 100A). I have also enabled Administrative Access - PING. The main IP address on this interface is 10.0.0.1/24 The second IP address on this interface is now 192.168.0.1/24 On Windows client PC I have main IP address: 10.0.0.23. Now I added additional IP address: 192.168.0.23 on network card properties. Why can`t I ping to 192.168.0.1 ? I have also other PC`s with 192.168.0.x addresses and I can ping to them.

[UkWizard]

Not sure if when you add a secondary IP, that the MAC address of the internal NIC would be the same for the first, but perhaps thats the issue? have a look by using the arp commands, like so; Show arp table # arp -a delete arp entry # arp -d 10.0.0.23 ping both IP' s and then look at the arp mac addresses for each. Why on earth you would want this kind of a setup is confusing though. I am presuming the client pc is on the same lan segment as the firewall interface.

[UkWizard]

whoops forgot to add, when you say you can ping to other machines on the 192.168.0.x network? are you saying that other pc' s have these secondary IP addresses and you can ping between themselves, but not to the fortigate?

[kcerb]

that`s correct UkWizard. I have a few test servers which are connected to the same phisical network but they have other IP subnet: 192.168.0.x. (only one IP address per network card) I can ping between themselves and I can ping from my PC client, who has two IP addresses (one 10.0.0.x, second 192.168.0.x) to those servers. I can`t ping from my client to fortigate and I can`t ping from test servers to fortigate.

[rwpatterson]

I have a similar situation with a second place I do work with. The solution I used was to have one IP address (per PC), and use the Fortigate to pass traffic between the LANs. Even though they are on the same wire, they need to pass through the FGT to see each other. Much less convoluted than the dual IP per machine method. All routing is done via the Fortigate with the added benefit of being able to control cross LAN traffic and bandwidth monitoring.

[kcerb]

I don`t want to see one network from another (except my client PC - one computer). All I want is internet access from the second subnet (192.168.0.x). In the second subnet I have only test PC`s and I want to Fortigate act as internet gate only.

[abelio]

did you set an internal->wan firewall policy for 192.168.0.0/24 nat-enabled?

[kcerb]

abelio, yes I did. But I even can not ping to Fortigate.

[UkWizard]

if you take out the 192.168. address out from your client, can you then ping the fortinet IP within the same subnet (ie 10.xxx) Also, what do you have as your default gateways on your machine and the test network machines? if they are all correct, then you should be able to ping that interface. but if routing doesnt work between the two, you will need a INTERNAL -> INTERNAL rule as well to allow the ' bouncing' traffic. You should also need to have two address entries in the fortinet with their interfaces selected, ie not left as any. But for the record, this is really really bad practice to have two subnets existing on the same segment. Do you not have a spare interface you could put the second network onto? thats the preferred method. Else i would recommend you invest in a switch that supports vlans, then do it that way, by vlanning them right up to the fortigate. you can do some sinple diags using the sniffer, so on the cli of the fortigate, run the following and then try a ping to the interface, and see if it hits it. if it doesnt, your switch must be screwing things up, potentially because of the dual subnet existence. # diag sniff packet any ' icmp'

[kcerb]

I am confused. Situation looks as follows: All test PC` have 192.168.0.1 as default gateway and have only one IP address set manually. FortiGate unit have two IP addresses: 10.0.0.1 (primary with PING enabled) and 192.168.0.1 (secondary with PING enabled). If I have only one address on my network card (192.168.0.100) and default gateway i set to 192.168.0.1, I can ping to other test PC`s but i can not ping to FortiGate. FortiGate`s sniffer shows only:

icmp: echo request

When I change IP address to 10.0.0.100 (still is only one IP) and default gateway is set to 10.0.0.1, I can not ping to other test PC`s and I can ping to FortiGate on 10.0.0.1 and I can ping to FortiGate on 192.168.0.1 too!! FortiGate`s sniffer shows :

icmp: echo request
 icmp: echo reply