Reply to post

Hot!Allow Traffic Between Different Ports with different ips

Author
gniedy
New Member
  • Total Posts : 9
  • Reward points: 0
  • Joined: 2019/08/16 04:00:40
  • Status: offline
2019/08/16 04:11:40 (permalink)

Allow Traffic Between Different Ports with different ips

I have to different ports on my Fortigate 
port 1 ( 10.201.0.0/16)
port 2 ( 192.168.0.0/16)
i need to allow traffic between both ports which will allow me to use all protocols i made a policy routes with a firewall-policy but nothing happen

19 Replies Related Threads

    ede_pfau
    Expert Member
    • Total Posts : 6046
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: Allow Traffic Between Different Ports with different ips 2019/08/16 05:10:07 (permalink)
    Delete the Policy Route. These networks already have (std) routes automatically, check Monitor > Routing Monitor.
    You just need one policy per direction. If you have one, right-click and 'clone reverse'.

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    gniedy
    New Member
    • Total Posts : 9
    • Reward points: 0
    • Joined: 2019/08/16 04:00:40
    • Status: offline
    Re: Allow Traffic Between Different Ports with different ips 2019/08/16 05:43:18 (permalink)
    thanks ede_pfau for your answer.
     
    do you mean firewall police or policy route? i did both with no result, sorry i am not expert with fortigate.
    ede_pfau
    Expert Member
    • Total Posts : 6046
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: Allow Traffic Between Different Ports with different ips 2019/08/16 06:05:23 (permalink)
    Well exactly, you only need a plain policy.
    Policy routing is routing - and that is already handled for you.

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    gniedy
    New Member
    • Total Posts : 9
    • Reward points: 0
    • Joined: 2019/08/16 04:00:40
    • Status: offline
    Re: Allow Traffic Between Different Ports with different ips 2019/08/16 06:07:25 (permalink)
    Hereunder my firewall configuration:
     
    config firewall policy
        edit 9
            set name "ALLOW LAN TO CCTV"
            set uuid 9df94930-c025-51e9-4feb-d27f2893ce1c
            set srcintf "port2"
            set dstintf "port1"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set service "ALL"
            set logtraffic all
            set fsso disable
            set nat enable
        next
    end
     
    ede_pfau
    Expert Member
    • Total Posts : 6046
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: Allow Traffic Between Different Ports with different ips 2019/08/16 06:11:43 (permalink)
    Why NAT?
    Usually, for LAN to LAN traffic, you don't use NAT.
     
    NAT is mandatory for LAN-to-Internet traffic, as the next router (with your ISP) doesn't know your subnets.
     
    Apart from that, your policy looks OK. A bit sloppy with 'all' instead of proper address object, but that will do as well.
    If this doesn't work for you, what exactly do you see if you, for example, ping from one host to the other?
    Can each host ping the FGT port belonging to his LAN?

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    gniedy
    New Member
    • Total Posts : 9
    • Reward points: 0
    • Joined: 2019/08/16 04:00:40
    • Status: offline
    Re: Allow Traffic Between Different Ports with different ips 2019/08/16 06:22:09 (permalink)
    i disabled the NAT.
     
    if i ping from fortigate with execute ping everything is ok. and if i ping with same subnets everything is ok. but when i am trying to ping from example ( 10.201.2.111 ) to ( 192.168.10.10 ) it shows request timed out
    ede_pfau
    Expert Member
    • Total Posts : 6046
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: Allow Traffic Between Different Ports with different ips 2019/08/16 06:41:49 (permalink)
    Check the hosts:
    - the default route needs to be the IP address of the FGT port it's connected to.

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    gniedy
    New Member
    • Total Posts : 9
    • Reward points: 0
    • Joined: 2019/08/16 04:00:40
    • Status: offline
    Re: Allow Traffic Between Different Ports with different ips 2019/08/16 10:22:29 (permalink)
    i can't change the default route, o i create a new route table with no result again. i know i miss something. please any more help
    Dave Hall
    Expert Member
    • Total Posts : 1475
    • Reward points: 0
    • Joined: 2012/05/11 07:55:58
    • Location: Canada
    • Status: offline
    Re: Allow Traffic Between Different Ports with different ips 2019/08/16 10:31:56 (permalink)
    Not sure if that is a typo: port 1 =10.201.0.0/16 and port 2 = 192.168.0.0/16 but creating a firewall policy that goes from port 2 to port 1 when attempting to ping from port1 to an address on port 2.  I think you may also need a firewall policy in the opposite direction.  
     
    post edited by Dave Hall - 2019/08/16 10:48:43

    NSE4/FMG-VM64/FortiAnalyzer-VM/5.4/6.0 (FWF40C/FW92D/FGT200D/FGT101E)/ FAP220B/221C
    gniedy
    New Member
    • Total Posts : 9
    • Reward points: 0
    • Joined: 2019/08/16 04:00:40
    • Status: offline
    Re: Allow Traffic Between Different Ports with different ips 2019/08/16 10:35:50 (permalink)
    i did beofre. i make 2 direction firewall policy and start to changing between them but also no result
    Dave Hall
    Expert Member
    • Total Posts : 1475
    • Reward points: 0
    • Joined: 2012/05/11 07:55:58
    • Location: Canada
    • Status: offline
    Re: Allow Traffic Between Different Ports with different ips 2019/08/16 11:00:17 (permalink)
    There should be a route to the network on port 2 for addresses on port 1 to follow.  I bet the only default route listed on the fgt is the one that is routing to the WAN or Internet. 
     
    On the CLI, type get router info routing-table details and see if there is a 192.168.0.0 route directed to port 2.  There should be considering it's a direct connection. 
     
    Make sure you have your subnet mask set correctly (/16 vs /24, etc.) .


    gniedy
    i did beofre. i make 2 direction firewall policy and start to changing between them but also no result




    NSE4/FMG-VM64/FortiAnalyzer-VM/5.4/6.0 (FWF40C/FW92D/FGT200D/FGT101E)/ FAP220B/221C
    ede_pfau
    Expert Member
    • Total Posts : 6046
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: Allow Traffic Between Different Ports with different ips 2019/08/16 11:17:34 (permalink)
    @Dave: both networks are directly connected (port1, port2) so this is not a routing issue on the FGT. I guess it's the hosts which are not addressing the traffic to the FGT.
     
    @gniedy: ping from the FGT CLI is not that much helpful. But when pinging from host to FGT, you should see successful replies. Do you?

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    Dave Hall
    Expert Member
    • Total Posts : 1475
    • Reward points: 0
    • Joined: 2012/05/11 07:55:58
    • Location: Canada
    • Status: offline
    Re: Allow Traffic Between Different Ports with different ips 2019/08/16 11:37:01 (permalink)
    Just realized that - the hosts themselves could have the wrong gw info configured, but at the back of my head was also thinking the subnet mask should be checked too.
     
    ede_pfau
    @Dave: both networks are directly connected (port1, port2) so this is not a routing issue on the FGT. I guess it's the hosts which are not addressing the traffic to the FGT.




    NSE4/FMG-VM64/FortiAnalyzer-VM/5.4/6.0 (FWF40C/FW92D/FGT200D/FGT101E)/ FAP220B/221C
    gniedy
    New Member
    • Total Posts : 9
    • Reward points: 0
    • Joined: 2019/08/16 04:00:40
    • Status: offline
    Re: Allow Traffic Between Different Ports with different ips 2019/08/16 15:56:47 (permalink)
    i found a bet mistake which i was configured the host with alternative Ip but when i delete the other ip the ping work from p1 to p2 but i still face some issues that  can't ping to fgt from the hosts to the different ports and i can ping from p1 host to p2 host but i can't ping from p2 host to p1 host or fgt you will find some pics from my configuration
    gniedy
    New Member
    • Total Posts : 9
    • Reward points: 0
    • Joined: 2019/08/16 04:00:40
    • Status: offline
    Re: Allow Traffic Between Different Ports with different ips 2019/08/16 16:05:54 (permalink)
    https://ibb.co/v13t9g5     (CLI Route)
    https://ibb.co/tqc042L     (FGT PORTS SUBNETS)
    https://ibb.co/JncpJJv      (Firewall Policy)
    https://ibb.co/kHMHTmV  (Ping From P1 to P2 host and fgt)
    https://ibb.co/P61VLMt    (Ping From P2 to P1 host and fgt)
     
    post edited by gniedy - 2019/08/17 01:34:01
    ede_pfau
    Expert Member
    • Total Posts : 6046
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: Allow Traffic Between Different Ports with different ips 2019/08/17 01:37:45 (permalink)
    Good to have some more information, thanks for the pics.
    One reason why you can't ping the FGT may be that PING is not allowed on the interfaces port1, port2. Make sure (in Network>Interfaces) that you tick "ping" as allowed management access.
     
    For the traffic from port1 to port2 you need a second policy - the "reverse clone" of the policy you already created.
    Do you supply your hosts via DHCP (from the FGT), or do you use static IPs, e.g. on the camera(s)? Static assignment always bears the risk of mistyping the address, the network mask, the gateway address, the DNS address...with DHCP, you define those centrally, and present and future hosts will use the correct and complete set of settings.

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    gniedy
    New Member
    • Total Posts : 9
    • Reward points: 0
    • Joined: 2019/08/16 04:00:40
    • Status: offline
    Re: Allow Traffic Between Different Ports with different ips 2019/08/18 01:30:52 (permalink)
    i don't know whats wrong, i configured everything, about the ping protocol, the ping is active and the issue that all protocols is not work well although all protocols allowed from the interfaces 1,2. i think i have another problem not with the interfaces or the firewal policy i think i have another problem which prevents what i need but i don't know where, is there any cloud fortigate device to test on it like others?
    ede_pfau
    Expert Member
    • Total Posts : 6046
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: Allow Traffic Between Different Ports with different ips 2019/08/18 06:54:25 (permalink)
    Pinging Windows devices may just fail because of the built-in firewall. A better target would be a printer, switch or other 'IoT' device.
     

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    barak
    New Member
    • Total Posts : 13
    • Reward points: 0
    • Joined: 2014/10/20 10:57:00
    • Status: online
    Re: Allow Traffic Between Different Ports with different ips 2019/08/19 05:47:31 (permalink)
    Thanks Ede so much. i knew where was the problem and i solved it, it wasn't fortigate problem. now everything is working well, thanks for your help
    Guest
    Quick Reply: (Open Full Version)
      Enter the random characters shown
    Submit Post
    Jump to:
    © 2019 APG vNext Commercial Version 5.5