Extra help: NAT/Route mode
This section provides instructions for troubleshooting connection issues in situations
when a NAT/Route configuration is used.
1. Use FortiExplorer if you can’t connect tot he FortiGate GUI or CLI
If you can’t connect to the FortiGate GUI or CLI, you may be able to connect using
FortiExplorer. See your FortiGate unit’s QuickStart Guide for details.
2. Check for equipment issues.
Verify that all network equipment is powered on and operating as expected. Refer to the
QuickStart Guide for information about connecting your FortiGate to the network and about
the information provided by the FortiGate unit LED indicators.
3. Check the physical network connections.
Check the cables used for all physical connections to ensure that they are fully connected
and do not appear damaged. Also check the Unit Operation dashboard widget, which shows
the connection status of FortiGate network interfaces (System > Dashboard > Status).
4. Verify that you can connect to the internal IP address of the FortiGate unit.
Use a web browser to connect to the web‑based manager from the FortiGate internal
interface by browsing to its IP address. From the PC, try to ping the internal interface IP
address; for example, ping 192.168.1.99 If you cannot connect to the internal interface,
verify the IP configuration of the PC. Go to the next step when you can connect to the
internal interface.
5. Check the FortiGate interface configurations.
Check the configuration of the FortiGate interface connected to the internal network, and
check the configuration of the FortiGate interface that connects to the Internet to make sure
it includes the proper addressing mode.
6. Verify that you can communicate from the FortiGate unit to the Internet.
Access the FortiGate CLI and use the execute ping command to ping an address or
domain name on the Internet. You can also use the execute traceroute command to
troubleshoot connectivity to the Internet.
7. Verify the DNS configurations of the FortiGate unit and the PCs.
Check for DNS errors by pinging or using traceroute to connect to a domain name; for
example:
ping www.fortinet.com
ping: cannot resolve www.fre.com: Unknown host
If the name cannot be resolved, the FortiGate unit or PC cannot connect to a DNS server
and you should confirm the DNS server IP addresses are present and correct.
8. Verify the security policy configuration.
Go to Policy > Policy > Policy and verify that an internal -> wan1 security policy has been
added and check the Session column to ensure that traffic has been processed. Check the
configuration of the policy to make sure that Enable NAT and Use Destination Interface
Address is selected.
9. Verify the static routing configuration.
Go to Router > Static > Static Routes and verify that the default route is correct. Go to
Router > Monitor > Router Monitor and verify that the default route appears in the list as
a static route. Along with the default route, you should see at least two connected routes,
one for each connected FortiGate interface.
On some FortiGate models, routing options are configured by going to System > Network >
Routing or through the CLI.
10. Disable web filtering.
A web filtering security policy may block access to the website that you are attempting to
connect to. This could happen because the configuration of the default web filter profile is
blocking access to the site.
It is also possible that FortiGuard Web Filtering has produced a rating error for the website,
causing the web filter profile to block access. A rating error could occur for a number of
reasons, including not being able to access FortiGuard. To fix this problem, go to Security
Profiles > Web Filter > Profile and, in the default profile, enable Allow Websites When
a Rating Error Occurs.
11. Verify that you can connect to the wan1 IP address of the FortiGate unit.
Once you have established that the internal network is operating, ping the FortiGate wan1
interface IP address. If you cannot connect to the wan1 interface, the FortiGate unit is not
allowing internal to wan1 sessions.
12. Verify that you can connect to the gateway provided by your ISP.
Try pinging the default gateway IP address from a PC on the internal network.
13. Consider changing the MAC address of your external interface
Some ISPs do not want the MAC address of the device connecting to their network cable
to change. If you have added a FortiGate unit to your network, you may have to change
the MAC address of the external interface (typically, WAN1) by using the following CLI
command:
config system interface
edit wan1
set macaddr <xx:xx:xx:xx:xx:xx>
end
end
14. Reset the FortiGate unit to factory defaults and try again
If all else fails, use the CLI command execute factoryreset. When prompted, type y
to confirm the reset.
">
