Hot!Configure mgmt interface with vlan | can't ping in from remote location

Author
toms73
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/01/17 13:40:31
  • Status: offline
2019/01/17 13:55:25 (permalink)
0

Configure mgmt interface with vlan | can't ping in from remote location

Version: FortiGate-VM64-KVM v5.4.4,build7605,170208 (GA)
I'm trying to setup fortinet management going through port1 with vlan 333, I was able to ping out from fortinet to outside world but unable to ping into fortinet from remote location. the setup is the following 
PC -> Juniper NFX250 -> Fortinet 
 
Please let me know as to why the packets are not going out from port1?
Did I do setup correctly?
I have another product attached to Juniper NFX250 and I can ping in and out without any issues.
 
below is my setup:
FortiGate-VM64-KVM (interface) # show

config system interface
    edit "port1"
        set vdom "root"

        set allowaccess ping https ssh http fgfm

        set type physical

        set role wan

        set snmp-index 2

    next

    edit "port2"

        set vdom "root"

        set type physical

        set snmp-index 3

    next

    edit "port3"

        set vdom "root"

        set type physical

        set snmp-index 4

    next

    edit "ssl.root"

        set vdom "root"

        set type tunnel

        set alias "SSL VPN interface"

        set snmp-index 1

    next

    edit "vlan333"

        set vdom "root"

        set ip 10.92.24.106 255.255.255.0

        set allowaccess ping https ssh http fgfm

        set role lan

        set snmp-index 5

        set interface "port1"

        set vlanid 333

    next

end



FortiGate-VM64-KVM # get router info routing-table all

Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP

       O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

       * - candidate default

 

C 10.92.24.0/24 is directly connected, vlan333
 below is what I'm seeing when I try to ping from remote location to Fortinet, the packets are coming in but going no where...
FortiGate-VM64-KVM # diag sniffer packet port1 "icmp" 10.92.24.106 -I port1
interfaces=[port1]
filters=[icmp]
pcap_lookupnet: port1: no IPv4 address assigned

0 packets received by filter
0 packets dropped by kernel

FortiGate-VM64-KVM # diag sniffer packet vlan333 "icmp" 10.92.24.106 -I port1
interfaces=[vlan333]
filters=[icmp]
3.796072 10.88.233.1 -> 10.92.24.106: icmp: echo request
4.795824 10.88.233.1 -> 10.92.24.106: icmp: echo request

 I'm also seeing this:
FortiGate-VM64-KVM # id=20085 trace_id=21 func=print_pkt_detail line=4793 msg="vd-root received a packet(proto=17, 0.0.0.0:68->255.255.255.255:67) from vlan333. "

id=20085 trace_id=21 func=init_ip_session_common line=4944 msg="allocate a new session-00002e79"

id=20085 trace_id=21 func=vf_ip_route_input_common line=2586 msg="find a route: flag=90000000 gw-255.255.255.255 via root"

id=20085 trace_id=21 func=fw_local_in_handler line=390 msg="iprope_in_check() check failed on policy 0, drop"

id=20085 trace_id=22 func=print_pkt_detail line=4793 msg="vd-root received a packet(proto=2, 10.92.24.44:0->224.0.0.251:0) from vlan333. "

id=20085 trace_id=22 func=init_ip_session_common line=4944 msg="allocate a new session-00002e7a"

id=20085 trace_id=22 func=ip_session_handle_no_dst line=5018 msg="trace"
 
 
 
#1

5 Replies Related Threads

    lobstercreed
    Gold Member
    • Total Posts : 132
    • Scores: 21
    • Reward points: 0
    • Joined: 2018/11/28 14:57:58
    • Location: Sedalia, MO
    • Status: offline
    Re: Configure mgmt interface with vlan | can't ping in from remote location 2019/01/18 06:41:17 (permalink)
    0
    Do you have trusted hosts set in your admin profiles?  All admin access methods are only allowed from trusted hosts.  You may have to open management up to the outside world if you want to ping from the outside world.
    #2
    toms73
    New Member
    • Total Posts : 4
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/01/17 13:40:31
    • Status: offline
    Re: Configure mgmt interface with vlan | can't ping in from remote location 2019/01/18 07:45:28 (permalink)
    0
    maybe it's broken with VLAN. I've tried but nothing with VLAN, works fine without VLAN. Do you mind giving examples or point a doc on this for CLI? The password is removed below....

    FortiGate-VM64-KVM (admin) # show
     

    config system admin
     

        edit "admin"
     

            set accprofile "super_admin"
     

            set vdom "root"
     

            set password ENC SH233pCKxJsRW96bJRMrjBtq3kUCo7ZRYnqqd/xxxxxxxxxxx
     

        next
     

        edit "doc-admin"
     

            set trusthost1 10.0.0.0 255.0.0.0
     

            set trusthost2 192.168.0.0 255.255.0.0
     

            set accprofile "super_admin"
     

            set vdom "root"
     

        next
     

    end
     


    post edited by toms73 - 2019/01/18 09:18:26
    #3
    Toshi Esumi
    Expert Member
    • Total Posts : 1648
    • Scores: 139
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: Configure mgmt interface with vlan | can't ping in from remote location 2019/01/18 09:09:09 (permalink)
    0
    Because you don't have a route back to 10.88.233.1.
    #4
    toms73
    New Member
    • Total Posts : 4
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/01/17 13:40:31
    • Status: offline
    Re: Configure mgmt interface with vlan | can't ping in from remote location 2019/01/18 09:21:21 (permalink)
    0
     Nevermind, I got it
    config router static
                    edit 1
                    set dst 0.0.0.0 0.0.0.0
                    set gateway 10.92.24.1
                    set device vlan333
                    next
                    end

    post edited by toms73 - 2019/01/18 09:36:09
    #5
    Toshi Esumi
    Expert Member
    • Total Posts : 1648
    • Scores: 139
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: Configure mgmt interface with vlan | can't ping in from remote location 2019/01/18 09:35:26 (permalink)
    0
    Since you don't have any routes configured, I'm assuming you're just testing with this FGT at this moment.
    If the vlan333 is dedicated for management and only 10.88.233.0/24 needs to reach the FGT, you can put like below in.
     
    config router static
        edit 0
            set dst 10.88.233.0 255.255.255.0
            set gateway <Juniper's_GW_address_in_10.92.24.0/24>
            set device vlan333
        next
    end
     
    Although I never touched FGT-VM, FGT config part shouldn't change between chassis ones and VM ones. Then you can search internet like "fortigate CLI static routes" and would find a bunch of online manual pages like below:
    https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-advanced-routing-54/Routing_Advanced_Static/static_example.htm
     
    You still need to add a default route to make anybody be able to use the FGT though.
    #6
    Jump to:
    © 2019 APG vNext Commercial Version 5.5