Running ping and traceroute

Ping and traceroute are useful tools in network troubleshooting. Alone, either tool can determine network connectivity between two points. However, ping can be used to generate simple network traffic that you can view using diagnose commands in FortiGate. This combination can be very powerful when you are trying to locate network problems.

Ping and traceroute can also tell you if your computer or network device has access to a domain name server (DNS). Both tools can use IP addresses or device domain names to determine why particular services, such as email or web browsing, may not work properly.

If ping does not work, it may be disabled on at least one of the interface settings and security policies for that interface.

Both ping and traceroute require particular ports to be open on firewalls to function. Since you typically use these tools to troubleshoot, you can allow them in the security policies and on interfaces only when you need them. Otherwise, keep the ports disabled for added security.

Ping

The ping command sends a very small packet to a destination, and waits for a response. The response has a timer that expires when the destination is unreachable.

Ping is part of layer 3 on the OSI Networking Model. Ping sends Internet Control Message Protocol (ICMP) “echo request” packets to the destination, and listens for “echo response” packets in reply. However, many public networks block ICMP packets because ping can be used in a denial of service (DoS) attack (such as Ping of Death or a smurf attack), or by an attacker to find active locations on the network. By default, FortiGate units have ping enabled while broadcast-forward is disabled on the external interface.

What ping can tell you

Beyond the basic connectivity information, ping can tell you the amount of packet loss (if any), how long it takes the packet to make the round trip, and the variation in that time from packet to packet.

If packet loss is detected, you should investigate the following:

• Possible ECMP, split horizon, or network loops.
• Cabling, to ensure there are no loose connections.
• Verify which security policy was used. To do this:

  Go to Policy & Objects > Firewall Policy and view the packet count column.

If there is total packet loss, you should investigate the following:

1. Ensure cabling is correct, and all equipment between the two locations is accounted for.
2. Ensure all IP addresses and routing information along the route is configured as expected.
3. Ensure all firewalls, including FortiGate security policies allow PING to pass through.

FortiGate ping options

Use the following CLI to view all the FortiGate ping options:

execute ping-options ?
adaptive-ping     Adaptive ping <enable|disable>.
data-size         Integer value to specify datagram size in bytes.
df-bit            Set DF bit in IP header <yes | no>.
interface         Auto | <outgoing interface>.
interval          Integer value to specify seconds between two pings.
pattern           Hex format of pattern, e.g. 00ffaabb.
repeat-count      Integer value to specify how many times to repeat PING.
reset             Reset settings.
source            Auto | <source interface IP>.
timeout           Integer value to specify timeout in seconds.
tos               IP type-of-service option.
ttl               Integer value to specify time-to-live.
use-sdwan         Use SD-WAN rules to get output interface <yes | no>.
validate-reply    Validate reply data <yes | no>.
view-settings     View the current settings for PING option.

adaptive-ping {enable | disable}	Enable or disable adaptive ping. FortiGate sends the next packet after the last response is received.
data-size <integer>	Specify the size of data in bytes. The size excludes ICMP header information. The data size allows you to control the ICMP datagram size to test the effects of different packet sizes on the connection. Enter an integer value from <0> to <65507>.
df-bit {yes | no}	Don't fragment bit. Prevent or allow the ICMP packet to fragment: yes: Prevent the ICMP packet from being fragmented. no: Allow the ICMP packet to be fragmented.
interface {auto | <outgoing interface>}	Specify the outgoing interface: auto: Automatically select the interface based on the destination and routing table. <outgoing interface>: Manually specify the interface to be used for ping. When source is specified, the IP address will be used as the ping source IP.
interval <integer>	Specify the time between pings in seconds. Enter an integer value from <1> to <2147483647>.
pattern <string>	Specify a pattern in hex format, for example, 00ffaabb, to be used in the data section of the ICMP packet.
repeat-count <integer>	Specify how many times to repeat the ping attempt. Enter an integer value from <1> to <2147483647>.
reset	Reset ping options to default values.
source {auto | <source interface IP>}	Specify the source IP address to use for sending out ping: auto: Selects the primary IP address of the source interface. <source interface ip>: Specify a source IP address for the interface used.
timeout <integer>	Specify in seconds how long to wait until the ping times out. Enter an integer value from <0> to <2147483647>.
tos	Set the type of service (ToS) field in the packet header to indicate the desired quality of service: default: Defaults to 0. lowcost: Minimize the cost. lowdelay: Minimize the delay. reliability: Maximize reliability. throughput: Maximize throughput.
ttl <integer>	Specify the time to live. Time to live is the number of hops the ping packet should be allowed to make before being discarded or returned. Enter an integer value from <1> to <1255>.
use-sdwan {yes | no}	Specify whether to use SD-WAN rules and policy routes. yes: The ping follows SD-WAN rules and policy routes. Usually used with other options, such as source, to match a specific SD-WAN rule that is based on a specific source address. no: Do not follow SD-WAN rules and policy routes.
validate-reply {yes | no}	Specify whether to validate reply data: yes: Validate reply data. no: Do not validate reply data.
view-settings	Display the current ping option settings.

How to use ping

Ping syntax is the same for nearly every type of system on a network.

To ping from a FortiGate unit:

1. Go to Dashboad, and connect to the CLI through either telnet or the CLI widget.

2. Enter execute ping 10.11.101.101 to send 5 ping packets to the destination IP address.

   To modify ping options, first apply your changes using the command execute ping-options <option> <setting>.

   # execute ping 10.11.101.101

   PING 10.11.101.101 (10.11.101.101): 56 data bytes

   64 bytes from 10.11.101.101: icmp_seq=0 ttl=255 time=0.3 ms

   64 bytes from 10.11.101.101: icmp_seq=1 ttl=255 time=0.2 ms

   64 bytes from 10.11.101.101: icmp_seq=2 ttl=255 time=0.2 ms

   64 bytes from 10.11.101.101: icmp_seq=3 ttl=255 time=0.2 ms

   64 bytes from 10.11.101.101: icmp_seq=4 ttl=255 time=0.2 ms

   --- 10.11.101.101 ping statistics ---

   5 packets transmitted, 5 packets received, 0% packet loss

   round-trip min/avg/max = 0.2/0.2/0.3 ms

3. Enter the domain name to test name resolution.

   # execute ping google.com
   PING google.com (142.250.179.78): 56 data bytes

To ping from a Microsoft Windows PC:

1. Open a command window.
2. Enter ping 10.11.101.100 to ping the default internal interface of the FortiGate with four packets.

   Other options include:

   • -t to send packets until you press Ctrl+C
   • -a to resolve addresses to domain names where possible
   • -n X to send X ping packets and stop

   C:\>ping 10.11.101.101

   Pinging 10.11.101.101 with 32 bytes of data:

   Reply from 10.11.101.101: bytes=32 time=10ms TTL=255

   Reply from 10.11.101.101: bytes=32 time<1ms TTL=255

   Reply from 10.11.101.101: bytes=32 time=1ms TTL=255

   Reply from 10.11.101.101: bytes=32 time=1ms TTL=255

   Ping statistics for 10.11.101.101:

   Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

   Approximate round trip times in milli-seconds:

   Minimum = 0ms, Maximum = 10ms, Average = 3ms

To ping from a Linux PC:

1. Go to a shell prompt.
2. Enter “ping 10.11.101.101”.

Traceroute

Where ping will only tell you if it reached its destination and returned successfully, traceroute shows each step of the journey to its destination and how long each step takes. If ping finds an outage between two points, you can use traceroute to locate exactly where the problem is.

Traceroute works by sending ICMP packets to test each hop along the route. It sends three packets, and then increases the time to live (TTL) setting by one each time. This effectively allows the packets to go one hop farther along the route. This is why most traceroute commands display their maximum hop count before they start tracing the route, which is the maximum number of steps it takes before it declares the destination unreachable. Also, the TTL setting may result in steps along the route timing out due to slow responses. There are many possible reasons for this to occur.

By default, traceroute uses UDP datagrams with destination ports numbered from 33434 to 33534. The traceroute utility may also offer the option to select use of ICMP echo request (type 8) instead, which the Windows tracert utility uses. If you must, allow both protocols inbound through the FortiGate security policies (UDP with ports from 33434 to 33534 and ICMP type 8).

To track traceroute packets in the GUI:

Go to Policy & Objects > Firewall Policy and view the packet count column.

This allows you to verify the connection and confirm which security policy the traceroute packets are using.

What traceroute can tell you

Both ping and traceroute verify connectivity between two points. However, only traceroute shows you each step in the connection path. Also, ping and traceroute use different protocols and ports, so one may succeed where the other fails.

You can verify your DNS connection using traceroute. If you enter an FQDN instead of an IP address for the traceroute, DNS tries to resolve that domain name. If the name isn't resolved, you have DNS issues.

Using traceroute

The traceroute command varies slightly between operating systems. In Microsoft Windows, the command name is shortened to “tracert”. Also, your output lists different domain names and IP addresses along your route.

To use traceroute on a Microsoft Windows PC:

1. Open a command window.

2. Enter tracert fortinet.com to trace the route from the PC to the Fortinet web site.

   C:\>tracert fortinet.com

   Tracing route to fortinet.com [208.70.202.225]

   over a maximum of 30 hops:

   1 <1 ms <1 ms <1 ms 172.20.120.2

   2 66 ms 24 ms 31 ms 209-87-254-xxx.storm.ca [209.87.254.221]

   3 52 ms 22 ms 18 ms core-2-g0-0-1104.storm.ca [209.87.239.129]

   4 43 ms 36 ms 27 ms core-3-g0-0-1185.storm.ca [209.87.239.222]

   5 46 ms 21 ms 16 ms te3-x.1156.mpd01.cogentco.com [38.104.158.69]

   6 25 ms 45 ms 53 ms te8-7.mpd01.cogentco.com [154.54.27.249]

   7 89 ms 70 ms 36 ms te3-x.mpd01.cogentco.com [154.54.6.206]

   8 55 ms 77 ms 58 ms sl-st30-chi-.sprintlink.net [144.232.9.69]

   9 53 ms 58 ms 46 ms sl-0-3-3-x.sprintlink.net [144.232.19.181]

   10 82 ms 90 ms 75 ms sl-x-12-0-1.sprintlink.net [144.232.20.61]

   11 122 ms 123 ms 132 ms sl-0-x-0-3.sprintlink.net [144.232.18.150]

   12 129 ms 119 ms 139 ms 144.232.20.7

   13 172 ms 164 ms 243 ms sl-321313-0.sprintlink.net [144.223.243.58]

   14 99 ms 94 ms 93 ms 203.78.181.18

   15 108 ms 102 ms 89 ms 203.78.176.2

   16 98 ms 95 ms 97 ms 208.70.202.225

   The first column on the left is the hop count, which cannot exceed 30 hops. When that number is reached, the traceroute ends.

   The second, third, and fourth columns display how much time each of the three packets takes to reach this stage of the route. These values are in milliseconds and normally vary quite a bit. Typically a value of <1ms indicates a local connection.

   The fifth column (farthest to the right) shows the domain name of the device and its IP address, or possibly only the IP address.

To perform a traceroute on a Linux PC:

1. Go to a command line prompt.
2. Enter “traceroute fortinet.com”.

   The Linux traceroute output is very similar to the Windows tracert output.

To trace a route from a FortiGate to a destination IP address in the CLI:

# execute traceroute www.fortinet.com

traceroute to www.fortinet.com (66.171.121.34), 32 hops max, 84 byte packets

1 172.20.120.2 0.637 ms 0.653 ms 0.279 ms

2 209.87.254.221 <static-209-87-254-221.storm.ca> 2.448 ms 2.519 ms 2.458 ms

3 209.87.239.129 <core-2-g0-2.storm.ca> 2.917 ms 2.828 ms 9.324 ms

4 209.87.239.199 <core-3-bdi1739.storm.ca> 13.248 ms 12.401 ms 13.009 ms

5 216.66.41.113 <v502.core1.tor1.he.net> 17.181 ms 12.422 ms 12.268 ms

6 184.105.80.9 <100ge1-2.core1.nyc4.he.net> 21.355 ms 21.518 ms 21.597 ms

7 198.32.118.41 <ny-paix-gni.twgate.net> 83.297 ms 84.416 ms 83.782 ms

8 203.160.228.217 <217-228-160-203.TWGATE-IP.twgate.net> 82.579 ms 82.187 ms 82.066 ms

9 203.160.228.229 <229-228-160-203.TWGATE-IP.twgate.net> 82.055 ms 82.455 ms 81.808 ms

10 203.78.181.2 82.262 ms 81.572 ms 82.015 ms

11 203.78.186.70 83.283 ms 83.243 ms 83.293 ms

12 66.171.127.177 84.030 ms 84.229 ms 83.550 ms

13 66.171.121.34 <www.fortinet.com> 84.023 ms 83.903 ms 84.032 ms

14 66.171.121.34 <www.fortinet.com> 83.874 ms 84.084 ms 83.810 ms