Running ping and traceroute
Ping and traceroute are useful tools in network troubleshooting. Alone, either tool can determine network connectivity between two points. However, ping can be used to generate simple network traffic that you can view using
diagnose commands in FortiGate. This combination can be very powerful when you are trying to locate network problems.
Ping and traceroute can also tell you if your computer or network device has access to a domain name server (DNS). Both tools can use IP addresses or device domain names to determine why particular services, such as email or web browsing, may not work properly.
If ping does not work, it may be disabled on at least one of the interface settings and security policies for that interface.
Both ping and traceroute require particular ports to be open on firewalls to function. Since you typically use these tools to troubleshoot, you can allow them in the security policies and on interfaces only when you need them. Otherwise, keep the ports disabled for added security.
The ping command sends a very small packet to a destination, and waits for a response. The response has a timer that expires when the destination is unreachable.
Ping is part of layer 3 on the OSI Networking Model. Ping sends Internet Control Message Protocol (ICMP) “echo request” packets to the destination, and listens for “echo response” packets in reply. However, many public networks block ICMP packets because ping can be used in a denial of service (DoS) attack (such as Ping of Death or a smurf attack), or by an attacker to find active locations on the network. By default, FortiGate units have ping enabled while broadcast-forward is disabled on the external interface.
What ping can tell you
Beyond the basic connectivity information, ping can tell you the amount of packet loss (if any), how long it takes the packet to make the round trip, and the variation in that time from packet to packet.
If packet loss is detected, you should investigate the following:
- Possible ECMP, split horizon, or network loops.
- Cabling, to ensure there are no loose connections.
- Verify which security policy was used. To do this:
Go to Policy & Objects > IPv4 Policy or Policy & Objects > IPv6 Policy and view the packet count column.
If there is total packet loss, you should investigate the following:
- Ensure cabling is correct, and all equipment between the two locations is accounted for.
- Ensure all IP addresses and routing information along the route is configured as expected.
- Ensure all firewalls, including FortiGate security policies allow PING to pass through.
How to use ping
Ping syntax is the same for nearly every type of system on a network.
To ping from a FortiGate unit:
- Go to Dashboad, and connect to the CLI through either telnet or the CLI widget.
exec ping 10.11.101.101to send 5 ping packets to the destination IP address. There are no options for this command.
Head_Office_620b # exec ping 10.11.101.101
PING 10.11.101.101 (10.11.101.101): 56 data bytes
64 bytes from 10.11.101.101: icmp_seq=0 ttl=255 time=0.3 ms
64 bytes from 10.11.101.101: icmp_seq=1 ttl=255 time=0.2 ms
64 bytes from 10.11.101.101: icmp_seq=2 ttl=255 time=0.2 ms
64 bytes from 10.11.101.101: icmp_seq=3 ttl=255 time=0.2 ms
64 bytes from 10.11.101.101: icmp_seq=4 ttl=255 time=0.2 ms
--- 10.11.101.101 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 0.2/0.2/0.3 ms
To ping from a Microsoft Windows PC:
- Open a command window.
ping 10.11.101.100to ping the default internal interface of the FortiGate with four packets.
Other options include:
-tto send packets until you press
-ato resolve addresses to domain names where possible
-n Xto send X ping packets and stop
Pinging 10.11.101.101 with 32 bytes of data:
Reply from 10.11.101.101: bytes=32 time=10ms TTL=255
Reply from 10.11.101.101: bytes=32 time<1ms TTL=255
Reply from 10.11.101.101: bytes=32 time=1ms TTL=255
Reply from 10.11.101.101: bytes=32 time=1ms TTL=255
Ping statistics for 10.11.101.101:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 10ms, Average = 3ms
To ping from a Linux PC:
- Go to a shell prompt.
Where ping will only tell you if it reached its destination and returned successfully, traceroute shows each step of the journey to its destination and how long each step takes. If ping finds an outage between two points, you can use traceroute to locate exactly where the problem is.
Traceroute works by sending ICMP packets to test each hop along the route. It sends three packets, and then increases the time to live (TTL) setting by one each time. This effectively allows the packets to go one hop farther along the route. This is why most traceroute commands display their maximum hop count before they start tracing the route, which is the maximum number of steps it takes before it declares the destination unreachable. Also, the TTL setting may result in steps along the route timing out due to slow responses. There are many possible reasons for this to occur.
By default, traceroute uses UDP datagrams with destination ports numbered from 33434 to 33534. The traceroute utility may also offer the option to select use of ICMP echo request (type 8) instead, which the Windows tracert utility uses. If you must, allow both protocols inbound through the FortiGate security policies (UDP with ports from 33434 to 33534 and ICMP type 8).
To track traceroute packets in the GUI:
Go to Policy & Objects > IPv4 Policy or Policy & Objects > IPv6 Policy (if applicable) and view the packet count column.
This allows you to verify the connection and confirm which security policy the traceroute packets are using.
What traceroute can tell you
Both ping and traceroute verify connectivity between two points. However, only traceroute shows you each step in the connection path. Also, ping and traceroute use different protocols and ports, so one may succeed where the other fails.
You can verify your DNS connection using traceroute. If you enter an FQDN instead of an IP address for the traceroute, DNS tries to resolve that domain name. If the name isn't resolved, you have DNS issues.
The traceroute command varies slightly between operating systems. In Microsoft Windows, the command name is shortened to “
tracert”. Also, your output lists different domain names and IP addresses along your route.
To use traceroute on a Microsoft Windows PC:
- Open a command window.
tracert fortinet.comto trace the route from the PC to the Fortinet web site.
Tracing route to fortinet.com [184.108.40.206]
over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms 172.20.120.2
2 66 ms 24 ms 31 ms 209-87-254-xxx.storm.ca [220.127.116.11]
3 52 ms 22 ms 18 ms core-2-g0-0-1104.storm.ca [18.104.22.168]
4 43 ms 36 ms 27 ms core-3-g0-0-1185.storm.ca [22.214.171.124]
5 46 ms 21 ms 16 ms te3-x.1156.mpd01.cogentco.com [126.96.36.199]
6 25 ms 45 ms 53 ms te8-7.mpd01.cogentco.com [188.8.131.52]
7 89 ms 70 ms 36 ms te3-x.mpd01.cogentco.com [184.108.40.206]
8 55 ms 77 ms 58 ms sl-st30-chi-.sprintlink.net [220.127.116.11]
9 53 ms 58 ms 46 ms sl-0-3-3-x.sprintlink.net [18.104.22.168]
10 82 ms 90 ms 75 ms sl-x-12-0-1.sprintlink.net [22.214.171.124]
11 122 ms 123 ms 132 ms sl-0-x-0-3.sprintlink.net [126.96.36.199]
12 129 ms 119 ms 139 ms 188.8.131.52
13 172 ms 164 ms 243 ms sl-321313-0.sprintlink.net [184.108.40.206]
14 99 ms 94 ms 93 ms 220.127.116.11
15 108 ms 102 ms 89 ms 18.104.22.168
16 98 ms 95 ms 97 ms 22.214.171.124
The first column on the left is the hop count, which can't exceed 30 hops. When that number is reached, the traceroute ends.
The second, third, and fourth columns display how much time each of the three packets takes to reach this stage of the route. These values are in milliseconds and normally vary quite a bit. Typically a value of
<1ms indicates a local connection.
The fifth column (farthest to the right) shows the domain name of the device and its IP address, or possibly only the IP address.
To perform a traceroute on a Linux PC:
- Go to a command line prompt.
The Linux traceroute output is very similar to the MicroSoft Windows
To trace a route from a FortiGate to a destination IP address in the CLI:
# execute traceroute www.fortinet.com
traceroute to www.fortinet.com (126.96.36.199), 32 hops max, 84 byte packets
1 172.20.120.2 0.637 ms 0.653 ms 0.279 ms
2 188.8.131.52 <static-209-87-254-221.storm.ca> 2.448 ms 2.519 ms 2.458 ms
3 184.108.40.206 <core-2-g0-2.storm.ca> 2.917 ms 2.828 ms 9.324 ms
4 220.127.116.11 <core-3-bdi1739.storm.ca> 13.248 ms 12.401 ms 13.009 ms
5 18.104.22.168 <v502.core1.tor1.he.net> 17.181 ms 12.422 ms 12.268 ms
6 22.214.171.124 <100ge1-2.core1.nyc4.he.net> 21.355 ms 21.518 ms 21.597 ms
7 126.96.36.199 <ny-paix-gni.twgate.net> 83.297 ms 84.416 ms 83.782 ms
8 188.8.131.52 <217-228-160-203.TWGATE-IP.twgate.net> 82.579 ms 82.187 ms 82.066 ms
9 184.108.40.206 <229-228-160-203.TWGATE-IP.twgate.net> 82.055 ms 82.455 ms 81.808 ms
10 220.127.116.11 82.262 ms 81.572 ms 82.015 ms
11 18.104.22.168 83.283 ms 83.243 ms 83.293 ms
12 22.214.171.124 84.030 ms 84.229 ms 83.550 ms
13 126.96.36.199 <www.fortinet.com> 84.023 ms 83.903 ms 84.032 ms
14 188.8.131.52 <www.fortinet.com> 83.874 ms 84.084 ms 83.810 ms