routing problem

[sel18]

Hello all,

on this lab, i can't ping to 8.8.8.8 or to the gateway (192.168.2.1).

i want to reach the cloud from any fortigate ( the address of the fortigate is a static address)

also i want to add a default router to the cloud from all the fortigate.

i am working on a local network.

please anyone could help ?

[balaji.bandi]

Post the router config, do you NAT in place in the router ?

[sel18]

router config!

int gi0/0

ip add 192.168.2.130 255.255.255.0

no shu

int gi0/3

ip add 192.168.3.133 255.255.255.0

no shu

ip def-getaway 192.168.2.1

ip route 0.0.0.0 0.0.0.0 gi0/3

what are mean by NAT in place the router ?

[balaji.bandi]

if you want your RFC 1918 address to reach internet, they need to NAT, since they are not routable IP address.

Until you have any other device which doint that TASK.  ( as per the picture you using EVE-ng or PNET emulator for this Lab) - so your DSL should do the NAT, or else you need to do NAT on Router

what is NAT explain here good way :

https://www.cbtnuggets.com/blog/technology/networking/networking-basics-what-is-nat

[sel18]

thanks @balaji.bandi ,

i am using eve-ng

did you mean that i should apply just on the the interface for exemple gi0/0 "ip nat inside" and on the interface gi0/3 "ip nat outside" ?

if yes ! i tried it but nothing is changed ! or the config miss another command ?

[balaji.bandi]

here is the example - test and advise. ( you should be able to ping 8.8.8.8)

remove this :

no ip def-getaway 192.168.2.1

before deploying below config from Router are you able to ping 8.8.8.8 ?

int gi0/0

ip nat inside

!

int gi0/1

ip nat inside

!

int gi0/2

ip nat inside

int gi0/3

iip nat outside

access-list 1 permit 192.168.2.0 0.255.255.255

access-list 1 permit 192.168.4.0 0.255.255.255

access-list 1 permit 192.168.5.0 0.255.255.255

ip nat inside source list 1 interface GigabitEthernet0/3 overload

[sel18]

@balaji.bandi 

no i can't ping to 8.8.8.8 that's the problem

[balaji.bandi]

Lets start form basic test :

from router you not able to ping  8.8.8.8 correct ?

192.168.1.133 ? you got from DHCP ? what is your PC IP ?  ( as the screen shot you have Lan IP 192.168.2.X /24 ?)

So your router should be in 192.168.2.X  to reach internet - this required to fix.

here good guide to start :

https://www.youtube.com/watch?v=SIZoaEbmXo8

[sel18]

@balaji.bandi 

i didn't get the add 192.168.3.133 from dhcp, it's a static address

i try to change the ip of gi0/3 to 192.168.2.130 but still can't ping to 8.8.8.8 from router !

[balaji.bandi]

Can you post the router config show run  and what is the results of ping any of your network device ? in the network 192.168.2.X from your Router ?

[sel18]

@balaji.bandi 

i try a new address ip for the interfaces

router#sh run

interface GigabitEthernet0/0
ip address 192.168.10.130 255.255.255.0
ip nat inside

interface GigabitEthernet0/3
ip address 192.168.2.130 255.255.255.0
ip nat outside

ip nat inside source list 1 interface GigabitEthernet0/3 overload
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/3 192.168.2.0
!
!
!
access-list 1 permit 192.168.10.0 0.0.0.255

[balaji.bandi]

what is the results of ping to any device in 192.168.2.x

remove below line

no ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/3 192.168.2.0

check ipconfig /all from your PC, what you see the Gateway ? take teh gateway and add below linne

ip route 0.0.0.0 0.0.0.0 192.168.2.X

post  below output :

show run ( FULL - not bit and pieces)

show ip route

[sel18]

@balaji.bandi 

the ping to 192.168.2.130 or .128 is working but to 192.168.2.1 didn't work

the gateway is 192.168.2.1

router# sh run

interface GigabitEthernet0/0
ip address 192.168.10.130 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/1
ip address 192.168.30.130 255.255.255.0
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/2
ip address 192.168.20.130 255.255.255.0
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/3
ip address 192.168.2.130 255.255.255.0
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
media-type rj45
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
ip nat inside source list 1 interface GigabitEthernet0/3 overload
ip route 0.0.0.0 0.0.0.0 192.168.2.1
!
!
!
access-list 1 permit 192.168.10.0 0.0.0.255
!

router# sh ip route

Gateway of last resort is 192.168.2.1 to network 0.0.0.0

S* 0.0.0.0/0 [1/0] via 192.168.2.1
192.168.2.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.2.0/24 is directly connected, GigabitEthernet0/3
L 192.168.2.130/32 is directly connected, GigabitEthernet0/3
192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.10.0/24 is directly connected, GigabitEthernet0/0
L 192.168.10.130/32 is directly connected, GigabitEthernet0/0
192.168.20.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.20.0/24 is directly connected, GigabitEthernet0/2
L 192.168.20.130/32 is directly connected, GigabitEthernet0/2
192.168.30.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.30.0/24 is directly connected, GigabitEthernet0/1
L 192.168.30.130/32 is directly connected, GigabitEthernet0/1

[balaji.bandi]

192.168.2.1   - Device should able to ping gateway before you proceed any further.- this more of your eve-ng setup issue. ( make sure you watch the video closly) the interface should map correctly.

is this your first time setup with eve-ng (it worked before ?)

From your PC you able to ping  192.168.2.1 and have internet ?

from eve-ng you able to get to 8.8.8.8 ?

[sel18]

@balaji.bandi 

i worked before with the eve but the issue is for the first time

yes i can ping to 8.8.8.8 from eve-ng

yes i can ping to 192.168.2.1 and to internet from my PC

PS: when i connected the fortigate with the cloud (without an router) is working and i can managed the fortigate

so i thing the problem is in the router ?