FG30E with FortiOS v6.0.1 build0131 - one host fails on policy 0 with drop

Author
cronus
New Member
  • Total Posts : 3
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/05/28 01:25:45
  • Status: offline
2018/08/10 02:56:29 (permalink)
0

FG30E with FortiOS v6.0.1 build0131 - one host fails on policy 0 with drop

Hi Guys,
 
I have strange problem on a FG30E with FortiOS v6.0.1 build0131 (GA).
 
The setup is the following:
I have a local lan with subnet 192.168.1.0/24. The lan ports of FG30E (as hardware switch) acts as gateway with interface ip 192.168.1.1/24.
The WAN port of FG30E (ip 192.168.2.254/24) is connected to a DSL-modem (Fritz!Box) in the subnet 192.168.2.0/24.
There is a default route 0.0.0.0/0 which points to the WAN interface and the ip of the Fritzbox (192.168.2.1/24).
 
There is one policy the allows all traffic from the lan to the internet:
show firewall policy 2
config firewall policy
edit 2
set name "Park-to-Internet"
set uuid b5ab8032-89a5-51e8-7074-46a0bd1754d1
set srcintf "lan"
set dstintf "wan"
set srcaddr "NET_192.168.1.0_Park"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
set logtraffic all
set nat enable
next
end
 
But one host inside the lan (192.168.1.153/24) shows the following error in the packet sniffer
...
id=20085 trace_id=134 func=print_pkt_detail line=5320 msg="vd-root:0 received a packet(proto=17, 192.168.1.153:49865->192.168.1.1:53) from lan. "
id=20085 trace_id=134 func=init_ip_session_common line=5480 msg="allocate a new session-00002f8c"
id=20085 trace_id=134 func=vf_ip_route_input_common line=2590 msg="find a route: flag=84000000 gw-192.168.1.1 via root"
id=20085 trace_id=134 func=fw_local_in_handler line=409 msg="iprope_in_check() check failed on policy 0, drop"
...
 
I have no idea why this error occurs and how to solve it.
I tried to create a lan-to-lan policy but the error still occurs.
 
Any suggestions?
 
Many thanks.
 
 
#1

3 Replies Related Threads

    neonbit
    Expert Member
    • Total Posts : 468
    • Scores: 51
    • Reward points: 0
    • Joined: 2013/07/02 21:39:52
    • Location: Dark side of the moon
    • Status: offline
    Re: FG30E with FortiOS v6.0.1 build0131 - one host fails on policy 0 with drop 2018/08/10 04:56:32 (permalink)
    0
    It looks like 192.168.1.153 is sending a DNS request to the FGT's interface of 192.168.1.1.
     
    Does the .153 machine have the FGT as it's DNS server? Are you using the FGT as your DNS server or is there another one?
    #2
    ede_pfau
    Expert Member
    • Total Posts : 5625
    • Scores: 382
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: FG30E with FortiOS v6.0.1 build0131 - one host fails on policy 0 with drop 2018/08/10 06:03:16 (permalink)
    0
    Same, create a DNS on the "lan" interface, set to "Same as System DNS" at least.
    So it looks like .1.153 is a DHCP host using .1.1 as it's DNS and other hosts don't.
     
    BTW, disable NAT on the FGT policy. The FB does it for you already.

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    #3
    cronus
    New Member
    • Total Posts : 3
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/05/28 01:25:45
    • Status: offline
    Re: FG30E with FortiOS v6.0.1 build0131 - one host fails on policy 0 with drop 2018/08/10 08:02:48 (permalink)
    0
    Thank you for your suggestions, neonbit and ede_pfau.
     
    After another research with my colleague we could solve the problem.
    The following KB entry helped us: http://kb.fortinet.com/kb/documentLink.do?externalID=FD40580
    In a nutshell:
    Enable DNS database feature
    Create DNS service on lan/internal interface with mode "Forward to System DNS"
    #4
    Jump to:
    © 2018 APG vNext Commercial Version 5.5