• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

PFSense (Netgate 4100) Setup with a Fortigate

Scheduled Pinned Locked Moved Firewalling
19 Posts 3 Posters 1.1k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • V
    viragomann @mofugga
    last edited by Dec 6, 2022, 10:14 PM

    @mofugga
    What if you configure the IP settings on the Fortigate WAN1 manually?

    Fist shrink the DHCP range on pfSense. Then set a static WAN IP on the Fortigate. Consider also state a upstream gateway in this case.

    Then try a ping to 8.8.8.8 from a client behind.

    M 1 Reply Last reply Dec 6, 2022, 10:24 PM Reply Quote 1
    • M
      mofugga @viragomann
      last edited by Dec 6, 2022, 10:24 PM

      @viragomann

      I set the range to 192.168.2.10 - 192.168.2.25 and then I connected my desktop to my fortigate and then manually set the Fortigate WAN2 interface to 'Manual' configuration with 192.168.2.1/24 as the IP/subnet and still am unable to receive a DHCP lease.

      V 1 Reply Last reply Dec 6, 2022, 10:30 PM Reply Quote 0
      • V
        viragomann @mofugga
        last edited by Dec 6, 2022, 10:30 PM

        @mofugga
        So you connected WAN2 to pfSense now?

        Setting a static IP for the network interface doesn't result in a DHCP lease. A lease can only be assigned to a DHCP client.

        interface to 'Manual' configuration with 192.168.2.1/24 as the IP/subnet

        This is the IP of the pfSense LAN as you wrote above. You have the set it to some other like 192.168.2.2/24.

        M 1 Reply Last reply Dec 6, 2022, 10:36 PM Reply Quote 1
        • M
          mofugga @viragomann
          last edited by mofugga Dec 6, 2022, 10:39 PM Dec 6, 2022, 10:36 PM

          @viragomann

          Ah yes, I meant IP assignment, not DHCP lease. Yes I have the Fortigate WAN2 connected to the PFSense Appliance LAN2. The PFsense appliance is connected to the modem.

          @viragomann said in PFSense (Netgate 4100) Setup with a Fortigate:

          This is the IP of the pfSense LAN as you wrote above. You have the set it to some other like 192.168.2.2/24.

          I tried setting the WAN2 interface on my Fortigate to have a 'Manual' configuration with 192.168.2.2/24 and still unable to connect

          V 1 Reply Last reply Dec 6, 2022, 10:52 PM Reply Quote 0
          • V
            viragomann @mofugga
            last edited by Dec 6, 2022, 10:52 PM

            @mofugga
            Does the Fortigate show even a connection on that interface?

            Can you ping pfSense from it?
            I assume, you have the default rule on pfSense LAN, which allow any traffic.

            M 1 Reply Last reply Dec 6, 2022, 11:03 PM Reply Quote 1
            • M
              mofugga @viragomann
              last edited by Dec 6, 2022, 11:03 PM

              @viragomann

              Yes, I have my PFsense rules on LAN set like this:

              Screenshot 2022-12-06 175705.png

              My Fortigate WAN2 interface was set like this:

              Screenshot 2022-12-06 175925.png

              When looking at the WAN2 interface in the fortigate CLI and running 'diag sniffer packet wan2 port 67 or port 68' I get this:

              Screenshot 2022-12-06 180241.png

              It is still not seeing the pfsense appliance I don't think.

              V 1 Reply Last reply Dec 6, 2022, 11:11 PM Reply Quote 0
              • V
                viragomann @mofugga
                last edited by Dec 6, 2022, 11:11 PM

                @mofugga said in PFSense (Netgate 4100) Setup with a Fortigate:

                When looking at the WAN2 interface in the fortigate CLI and running 'diag sniffer packet wan2 port 67 or port 68' I get this:

                Seems to be a wrong syntax.
                Anyway you won't see any packets on these ports, since there is no DHCP client enabled now.

                But again, can you ping 192.168.1.1?

                Apart from the IP and mask you also have to state the pfSense IP as upstream gateway.

                M 1 Reply Last reply Dec 6, 2022, 11:18 PM Reply Quote 1
                • M
                  mofugga @viragomann
                  last edited by Dec 6, 2022, 11:18 PM

                  @viragomann

                  When I try to ping 192.168.1.1 I get this:

                  Screenshot 2022-12-06 181712.png

                  @viragomann said in PFSense (Netgate 4100) Setup with a Fortigate:

                  Apart from the IP and mask you also have to state the pfSense IP as upstream gateway.

                  What do you mean state the pfSense IP as upstream gateway? I think I may know what you mean but I am not sure how to do this. My desktop sees 192.168.1.99 as the gateway which is my fortigate device. However I want it to be 192.168.2.1 which is my pfsense appliance. Perhaps my fortigate device is not seeing my pfsense appliance?

                  V 1 Reply Last reply Dec 6, 2022, 11:25 PM Reply Quote 0
                  • V
                    viragomann @mofugga
                    last edited by Dec 6, 2022, 11:25 PM

                    @mofugga
                    I was talking about the Fortigate.
                    Run the ping on the Fortigate. I assume, there is a possibility to do this.

                    And you have to set the default gateway on the Fortigate to 192.168.1.1.

                    M 1 Reply Last reply Dec 6, 2022, 11:39 PM Reply Quote 1
                    • M
                      mofugga @viragomann
                      last edited by Dec 6, 2022, 11:39 PM

                      @viragomann

                      I added a static route to the fortigate to try to go to 192.168.2.1 which is what I have the pfsense appliance to.

                      Screenshot 2022-12-06 183226.png

                      And then I checked the WAN2 interface on the fortigate. The fortigate and PFsense appliance are connected on the fortigate WAN2 and PFsense LAN2.

                      Screenshot 2022-12-06 183348.png

                      And then I went to the fortigate CLI to try to ping the pfsense appliance from the fortigate. Still not connectivity.

                      Screenshot 2022-12-06 183309.png

                      B 1 Reply Last reply Dec 7, 2022, 7:27 AM Reply Quote 0
                      • B
                        bingo600 @mofugga
                        last edited by bingo600 Dec 7, 2022, 7:28 AM Dec 7, 2022, 7:27 AM

                        @mofugga
                        Show your pfSense "Connect interface definition" , where the fortigate is connected.

                        Always check the Firewall logs , when having issues.
                        Find it here: Status --> System Logs --> Firewall

                        b8ca5d9d-41fd-4570-93c0-1febc0bc2cc8-image.png

                        Imho you should concentrate on : Getting the fortigate to ping the pfSense IF on the connect net (192.168.2.1)
                        Remember to allow ICMP on that connect interface , or the pfSense would drop the packages.

                        Edit: Why does the fortigate show WAN2 .... Do you have a WAN1 Active on the fortigate ???

                        If you find my answer useful - Please give the post a 👍 - "thumbs up"

                        pfSense+ 23.05.1 (ZFS)

                        QOTOM-Q355G4 Quad Lan.
                        CPU  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                        LAN  : 4 x Intel 211, Disk  : 240G SAMSUNG MZ7L3240HCHQ SSD

                        M 2 Replies Last reply Dec 8, 2022, 11:26 PM Reply Quote 1
                        • M
                          mofugga @bingo600
                          last edited by mofugga Dec 8, 2022, 11:31 PM Dec 8, 2022, 11:26 PM

                          This post is deleted!
                          1 Reply Last reply Reply Quote 0
                          • M
                            mofugga @bingo600
                            last edited by mofugga Dec 8, 2022, 11:38 PM Dec 8, 2022, 11:35 PM

                            @bingo600

                            EDIT: Deleted and reposted for formatting.

                            Here are my PFSense Interfaces. Because the Fortigate has a default IP address of 192.168.1.99 and default subnet of 192.168.1.X I changed the PFsense subnet to 193.169.2.X:

                            PFsense Interfaces
                            Screenshot 2022-12-08 175403.png

                            PFSense LAN2 Rules (Where the PFSense LAN2 Interface is connected to the Fortigate WAN1 inteface
                            Screenshot 2022-12-08 175044.png
                            I have the "Log packets that are handled by this rule" box checked for all rules here.

                            LAN2 Attempting DHCP ConfigurationScreenshot 2022-12-08 175155.png

                            However, when I attempt to physically connect my desktop to my Fortigate and initiate an outbound connection in this configuration. I can see in my Fortigate logs that traffic is being sent out correctly, but return traffic is being stopped further upstream, presumably at my PFSense appliance.

                            This is the configuration I mean.test4.jpg

                            My desktop is connected to the fortigate's LAN port 4, the fortigate WAN1 is connected to the PFSense appliance VLAN2, and the PFsense appliance is connected to the modem.

                            When running in this configuration and making a browser request to google.com I am still not getting and response back.
                            Screenshot 2022-12-08 180028.png.

                            When checking the Fortigate logs, I can see the outbound traffic being sent, but that 0 bytes are being received:
                            Screenshot 2022-12-08 180058.png.
                            However, I do not think this is because of my Fortigate firewall policy. This is the only policy I have from my internal traffic to WAN1:
                            Screenshot 2022-12-08 180141.png.

                            I do have Squid setup on my PFsense device.

                            I am still unable to ping the PFSense appliance from my Fortigate device even though I changed all of the rules on LAN2 of the PFSense appliance to accept IPv4+6 TCP/UDP/ICMP traffic and to log all captured packets. DHCP works fine in this configuration when I remove the Fortigate from the equation entirely:

                            test.jpg.

                            The DHCP lease is also assigned correctly when I have it in this configuration as well. 192.169.2.11 is my desktop. Screenshot 2022-12-08 182416.png. But for whatever reason, the testing I have done to have PFSense and Fortigate find each other on the network either when I set the interface on the Fortigate to MANUAL or DHCP - they still seem to be unable to find eachother.

                            M 1 Reply Last reply Dec 9, 2022, 2:41 AM Reply Quote 0
                            • M
                              mofugga @mofugga
                              last edited by Dec 9, 2022, 2:41 AM

                              @mofugga

                              Never mind. I figured it out. I had to configure the LAN interface to have the appropriate rules. Thanks everyone for your help.

                              1 Reply Last reply Reply Quote 0
                              19 out of 19
                              • First post
                                19/19
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                This community forum collects and processes your personal information.
                                consent.not_received