1

I am trying to get communication across a firewall, but I am unable to ping anything past the firewall.

PC1:172.16.201.22 <-> Router:172.16.192.1 <-> Firewall_Port1:10.10.10.4 <-> Firewall_Port2:192.168.11.201 <-> PC2:192.168.11.221

Router Config

interface GigabitEthernet0/0
 description
 ip address 10.10.10.2 255.255.255.248
 ip access-group ESP_in in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 no ip route-cache
 standby 1 ip 10.10.10.1
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 mtu 9576
 no ip address
 no ip route-cache
 duplex auto
 speed auto
!
interface GigabitEthernet0/1.101
 encapsulation dot1Q 101
 ip address 172.16.96.2 255.255.240.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 no ip route-cache
 standby 101 ip 172.16.96.1
!
interface GigabitEthernet0/1.201
 encapsulation dot1Q 201
 ip address 172.16.192.2 255.255.240.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 no ip route-cache
 standby 201 ip 172.16.192.1
!
!
ip route 172.16.16.0 255.255.255.0 10.10.10.4
ip route 172.16.96.0 255.255.240.0 10.10.10.4
ip route 192.168.1.0 255.255.255.0 10.10.10.4
ip route 192.168.11.0 255.255.255.0 10.10.10.4
!

Firewall Static IP

Firewall Interface

Policies

  • No policies? The Fortigate doesn't route anything without policy. – Zac67 Mar 26 at 17:19
  • @Zac67 I do have policies... I'll post them – d5343 Mar 26 at 17:20
  • Please provide clear diagram. It looks like a routing error. – infra Mar 27 at 6:17
  • I don't see any route or interface on the fortinet to reach 172.16.201.22. – Teun Vink Mar 27 at 6:18
  • Have you checked the log? It should show the deny. If not, at least temporarily set the policy to log always. Also, check out the policy editor's Policy Lookup feature (both ways), it's very handy. The policy snapshot you posted is very cryptical and practically useless without the object definitions. – Zac67 Mar 27 at 10:19
1

Device that I was trying to communicate with past firewall did not have Default Gateway IP configured...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.