01-27-2024 04:27 AM - edited 01-27-2024 05:45 AM
I have servers within the same LAN and VLAN, all connected through a switch, with the Fortigate serving as the gateway. Server 1 and Server 3 can successfully ping each other. However, I'm encountering an issue where neither Server 1 nor Server 3 can ping Server 2. Interestingly, I can ping Server 2 from the WAN side, passing through the Fortigate policy. I have already checked the firewall settings on the servers, and to further investigate, I connected my PC in place of Server 2 and found that it is pingable from the other servers.
OS: all servers running centos on the physical server and debian on the virtual server (they are not in the same physical)
I'm feeling a bit confused about this situation. Can you please provide some guidance and assistance?
Solved! Go to Solution.
01-30-2024 12:34 AM
thank you all i got the solution
there was a vpn misconfigured in server 2
01-27-2024 04:47 AM
Still new to trying to assist others, so excuse me if this is too basic of a probable cause. When you connected the PC in lieu of Server 2, did the PC receive the same IP address that server 2 was receiving? The reason I ask is I am immediately thinking an ACL may be in place to disallow icmp from the servers.
01-27-2024 04:49 AM
yes i fixed the same ip on my pc
01-27-2024 04:50 AM
This looks for me Server2 having Firewall May be ) not sure what is Server 2 (Linux / windows Server ? or others ?)
From Server 2 are you able to ping own Gateway and Server 1 and Server 2 ?
You have mentioned only FortiGate here, you have not mentioned what Switches attached ? what each Server belong to what VLAN ? is the switch act as Layer 2 or Layer 3 ?
01-27-2024 05:35 AM
thank you for your replie
yes i can ping server 1 from server2 but not opposite
switch act as layer 2
servers are in the same vlan
01-27-2024 06:21 AM
yes i can ping server 1 from server2 but not opposite
This sound lke local Server have FW - i have asked some question before ?
not sure what is Server 2 (Linux / windows Server ? or others ?)
try :
https://learn.microsoft.com/en-us/mem/intune/user-help/you-need-to-enable-defender-firewall-windows
01-27-2024 06:33 AM
thank you
i pointed that all servers running centos on the physical server and debian on the virtual server (they are not in the same physical)
01-27-2024 06:52 AM
Centos generally new Server have iptables enabled
for testing you can Flush ip tables :
iptables -xnvL (post output)
iptables -F
you can check as below :
ps -ef | grep ufw
ps -ef | grep firewall
you can disable if you running firewalld
systemctl status firewalld (check the status)
systemctl stop firewalld (stop the firewall) if you like to start again - systemctl start firewalld
If you using UFW firewal :
ufw status (if this running )
ufw allow icmp (can allow ICMP)
01-27-2024 05:13 AM
All server in same VLAN so forti have no any rule in this traffic
This traffic is l2 so it not pass throught forti.
You need to check FW on OS of server it can drop the ping.
MHM
01-27-2024 05:20 AM
Also check if server 2 has the correct mask for the subnet. A wrong/different mask would force the server to use the gateway.
01-27-2024 06:46 AM
Hello,
can you post the output below from all three servers:
ip a
sudo ufw status
as well as the content of '/etc/hosts.allow' ?
01-27-2024 07:23 AM
server 1
server 2
01-27-2024 07:37 AM
Another output nice to see is arp -a from all servers.
01-30-2024 12:34 AM
thank you all i got the solution
there was a vpn misconfigured in server 2
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide