Troubleshooting Transparent mode installations
1 of 3
http://docs-legacy.fortinet.com/cb/html/FOS_Cookbook/Install-basic/cb...
The basics of installing and initial setup of a new FortiGate unit : Troubleshooting Transparent mode installations
Troubleshooting Transparent mode installations
Problem
You set up a basic FortiGate Transparent mode configuration, and traffic will not pass through the FortiGate unit.
Solution
Use the following steps to find and fix the problem that is preventing users from connecting through the FortiGate
unit.
1 Check the physical network connections between the network and the FortiGate unit, and between the
FortiGate unit and the Internet.
The Unit Operation dashboard widget indicates the connection status of FortiGate network interfaces.
2 Check the router and ISP-supplied equipment to make sure it is operating correctly.
3 Verify that you can connect to the internal interface by connecting to the management IP address of the
FortiGate unit from the Internal network.
From the internal network, attempt to ping the management IP address. If you cannot connect to the internal
interface, verify the IP configuration of the PC and make sure the cables are connected and all switches and
other devices on the network are powered on and operating. Go to the next step when you can connect to the
internal interface.
4 To verify that you can communicate from the FortiGate unit to the Internet, access the FortiGate CLI and use
the execute ping command to ping an address on the Internet. You can also use the execute
traceroute command to troubleshoot connectivity to the Internet.
5 Verify the DNS configurations of the FortiGate unit and the PCs on the internal network. You can check for
DNS errors by pinging or using traceroute to connect to a domain name. If the name cannot be resolved the
FortiGate unit or PC cannot connect to a DNS server and you should confirm the DNS server IP addresses are
present and correct. For example:
ping www.fortinet.com
ping: cannot resolve www.fre.com: Unknown host
6 Verify the security policy configuration.
07-02-2015 16:05
Troubleshooting Transparent mode installations
2 of 3
http://docs-legacy.fortinet.com/cb/html/FOS_Cookbook/Install-basic/cb...
• Go to Policy > Policy > Policy and verify that an internal -> wan1 security policy has been added. Check
the Count column to see if the policy has been processing traffic. Check the configuration of the policy to
make sure it is similar to the following:
Source Interface/Zone
internal
Source Address
all
Destination Interface/Zone wan1
Destination Address
all
Schedule
always
Service
ANY
Action
ACCEPT
7 Verify the static routing configuration.
Go to System > Network > Routing Table and verify that the default route is correct.
8 Disable web filtering.
If you have enabled web filtering in a security policy it may be blocking access to the web site that you are
attempting to connect to. If disabling web filtering allows you to connect to the Internet with a web browser,
then the web filter profile selected in the policy was blocking access to the site you were attempting to connect
to. This could happen because the configuration of the default web filter profile is blocking access to your site.
Its also possible that FortiGuard Web Filtering produced a rating error for the web site and the default web
filter profile is configured to block access to sites when a rating error occurs. A rating error could occur for a
number of reasons, including not being able to access FortiGuard web filter ratings. To fix this problem, you
can go to UTM Profiles > Web Filter > Profile, and in the default profile, select Advanced Filter and enable
the Allow Websites When a Rating Error Occurs option.
9 Verify that you can connect to the gateway provided by your ISP. Try pinging the default gateway IP address
from a PC on the internal network.
10 Confirm that the FortiGate unit can connect to the FortiGuard network.
Once registered, the FortiGate unit obtains antivirus and application control and other updates from the
FortiGuard network. Once the FortiGate unit is on your network, you should confirm that it can reach the
FortiGuard network. The FortiGate unit must be able to connect to the network from its management IP
address. If the following tests provide incorrect results, the FortiGate unit cannot connect to the Internet from
its management IP address. Check the FortiGate unit’s default route to make sure it is correct. Check your
Internet firewall to make sure it allows connections from the FortiGate management IP address to the Internet.
First, check the License Information dashboard widget to make sure the status of all FortiGuard services
matches the services that you have purchased. The FortiGate unit connects to the FortiGuard network to
obtain this information.
Go to System > Config > FortiGuard. Open web filtering and email options and select Test Availability.
After a minute the web-based manager should indicate that the connection was successful.
11 Check the FortiGate bridge table.
The bridge table is a list of MAC addresses of devices on the same network as the FortiGate unit and the
FortiGate interfaces from which each MAC address was found. The FortiGate unit uses this table to determine
where to forward a packet. If a the MAC address of a specific device is getting added to in the bridge table,
then packets to that MAC address will be blocked. This may appear as traffic going to a MAC address, but no
reply traffic coming back. In this situation, check the bridge table to ensure the correct MAC addresses have
been added to the bridge table. Use the following CLI command to check the bridge table associated with the
root VDOM.
diagnose netlink brctl name host root.b
show bridge control interface root.b host.
07-02-2015 16:05
Troubleshooting Transparent mode installations
3 of 3
http://docs-legacy.fortinet.com/cb/html/FOS_Cookbook/Install-basic/cb...
fdb: size=2048, used=25, num=25, depth=1
Bridge root.b host table
port no device devname mac addr ttl attributes
3 4 wan1 00:09:0f:cb:c2:77 88
3 4 wan1 00:26:2d:24:b7:d3 0
3 4 wan1 00:13:72:38:72:21 98
4 3 internal 00:1a:a0:2f:bc:c6 6
1 6 dmz 00:09:0f:dc:90:69 0 Local Static
3 4 wan1 c4:2c:03:0d:3a:38 81
3 4 wan1 00:09:0f:15:05:46 89
3 4 wan1 c4:2c:03:1d:1b:10 0
2 5 wan2 00:09:0f:dc:90:68 0 Local Static
If your device’s MAC address is not listed, the FortiGate unit cannot find the device on the network. This could
indicate that the device is not connected or not operating. Check the device’s network connections and make
sure it is operating correctly.
07-02-2015 16:05
">
