strange error with Fortigate 80C

[Quang_Anh]

Dear Fortinet Support Team,

I would like to aking you about Fortigate devices problem.

Please check file attached & note listed below for more information.

1. Error: User cannot connect Internet 

2. Troubleshooting

# Firstly, I connected directly between modem and personal laptop, Internet working normally. Therefore error not caused by Internet service provide (100% for sure).

# Sencondly, I tried to connect my laptop to Fortigate (via LAN port on Fortigae) Details: Internet -- Modem -- Fortigate 80C (LAN port) -- My laptop Result: cannot connect to Internet. (I also tried to reboot Fortigate devices, but nothing get better)

# Next step, I tried to check Cisco Switch Layer 3 (reboot, clear and reload configuration), due to 2 options

Option1 : Internet -- Modem -- Fortigate 80C -- Switch L3 -- My laptop : cannot connect Internet Option2 : Internet -- Modem -- Switch L3 -- My laptop : cannot connect Internet

# Finally : when I connect modem directly to Cisco Switch Layer 2, (now Modem working as a DHCP server), internet back to work normally !! Internet -- Modem (act as DHCP Server) -- Switch L2 -- My laptop In my opinion, error maybe caused by Fortigate devices (Sw L3 working normally).

Once time, I got an same error with Fortigate 80C, suddently usercannot connect to Internet . When I downgrade Fortigate's firmware to lower version, devices & internet back to work normally !!!

So, please kindly support me in this case. What I have to do to solve this problem? (Downgrade firmware? Re-config Fortigate by manual? Or any solution?)

Looking foward to hearing from you.

Thank you in advance.

[ashukla_FTNT]

Post the following:

1) Ip address details (pc, L3 switch, firewall, modem)

2) Firewall interface and policy configuration

3) Are you able to ping firewall lan ip from pc

4) Are you able to ping modem ip from firewall CLi

[Quang_Anh]

Dear ASHUKLA,

Sorry for late reply, kindly check note below for more details

ashukla wrote:

1) Ip address details (pc, L3 switch, firewall, modem)

MODEM 1 Wan IP: 118.70.133.133 LAN IP: 192.168.99.1

MODEM 2 Wan IP: 113.190.242.88 LAN IP: 192.168.98.1

Fortigate 1 IP to Modem 1: 192.168.99.2 IP to Sw 3750X: 192.168.1.1

Fortigate 2 IP to Modem 2: 192.168.98.2 IP to Sw 3750X: 192.168.1.1

Cisco Sw 3750X: 192.168.10.254

ashukla wrote:

2) Firewall interface and policy configuration

==> Please check file attached

ashukla wrote:

3) Are you able to ping firewall lan ip from pc

4) Are you able to ping modem ip from firewall CLi

==> Ping working as normally

Looking forward to hear from you

Thanks in advance

[ashukla_FTNT · Accepted solution]

Did you enable nat in policy ?

Even though modem is doing nat it will only know about the 192.168.99.0 network (modem 1 case). So if have not enabled nat in firewall policy the traffic will go with original source address and that will be dropped by modem?

Also make sure you have setup the route for the internal network 192.168.10.0 network if you are connecting devices behind the switch.

If you still face the problem do the following from CLI:

diag debug reset

diag debug disable

diag debug enable

diag debug flow filter addr 4.2.2.2

diag debug console timestamp enable

diag debug flow show console enable

diag debug flow trace start 200

Now connect a pc directly to the lan of Fortigate and from pc's cmd run a ping to 4.2.2.2.

You will see some debug output on fortigate CLI.

stop the debug using the command: diag debug disable

post the output.

[emnoc]

Ditto , I would start with a diag debug flow  and work from the output that you see in that diagnostic