A doctor who looks at a patient has to perform some diagnostics and probably in a certain order.
The same applies with a fortigate firewall. Here's a few tips on that order;
1: Validate the Routing table
Yes, sounds stupid but a lot of person fail to do just this. You can use any of the following;
ping ( not ideal due to they could be blocked )
traceroute ( more ideal but any path on the trace could fail to respond )
NOTE: This also validates the interfaces and next-hop gateways are up.
2: Conduct a packet sniffer ( diag sniffer packet )
Simple do you see traffic matching the 2 objects ( SRC & DST address )? You can do this from the command line on most fortigates and depending on OS version from the WebGUI.
3: diag debug flow
Almost always you want to conduct a simple diagnostic debug flow. This will validate the fwpolicy and traffic matching the policy ID
reference one of my earlier posts; http://socpuppet.blogspot.com/2013/03/flow-diagnostic-fortigate.html
The above 3 tips, will save a lot of time and provide a quicker resolution imho.
Freelance Network & Security Engineer
kfelix -a--t- socpuppets ---d--o--t--- com
=( ! ! )=