1

I am trying to get communication across a firewall, but I am unable to ping anything past the firewall.

PC1:172.16.201.22 <-> Router:172.16.192.1 <-> Firewall_Port1:10.10.10.4 <-> Firewall_Port2:192.168.11.201 <-> PC2:192.168.11.221

Router Config

interface GigabitEthernet0/0
 description
 ip address 10.10.10.2 255.255.255.248
 ip access-group ESP_in in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 no ip route-cache
 standby 1 ip 10.10.10.1
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 mtu 9576
 no ip address
 no ip route-cache
 duplex auto
 speed auto
!
interface GigabitEthernet0/1.101
 encapsulation dot1Q 101
 ip address 172.16.96.2 255.255.240.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 no ip route-cache
 standby 101 ip 172.16.96.1
!
interface GigabitEthernet0/1.201
 encapsulation dot1Q 201
 ip address 172.16.192.2 255.255.240.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 no ip route-cache
 standby 201 ip 172.16.192.1
!
!
ip route 172.16.16.0 255.255.255.0 10.10.10.4
ip route 172.16.96.0 255.255.240.0 10.10.10.4
ip route 192.168.1.0 255.255.255.0 10.10.10.4
ip route 192.168.11.0 255.255.255.0 10.10.10.4
!

Firewall Static IP

Firewall Interface

Policies

Improve this question
6
  • No policies? The Fortigate doesn't route anything without policy.
    – Zac67 ♦
    Commented Mar 26, 2019 at 17:19
  • @Zac67 I do have policies... I'll post them
    – d5343
    Commented Mar 26, 2019 at 17:20
  • Please provide clear diagram. It looks like a routing error.
    – infra
    Commented Mar 27, 2019 at 6:17
  • I don't see any route or interface on the fortinet to reach 172.16.201.22.
    – Teun Vink
    Commented Mar 27, 2019 at 6:18
  • Have you checked the log? It should show the deny. If not, at least temporarily set the policy to log always. Also, check out the policy editor's Policy Lookup feature (both ways), it's very handy. The policy snapshot you posted is very cryptical and practically useless without the object definitions.
    – Zac67 ♦
    Commented Mar 27, 2019 at 10:19

1 Answer 1

Reset to default
1

Device that I was trying to communicate with past firewall did not have Default Gateway IP configured...

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.