Interconnecting Junos and FortiOS

I am trying to connect two routers.
A Fortigate 200B (FortiOS v5.0,build0147 (GA Patch 1)) and a Juniper SRX240H (JUNOS Software Release [11.4R5.5]).

Here is a quick diagram of the topology:


I can ping PC1 from SERVER1.
I can ping from FortiGate 200B.
I cannot ping SERVER1 from PC1.
I cannot ping from SRX240H.

FGT200B created a directly connected route for and is pushing it through
I cannot see the same thing on SRX240H. I tried creating a route to on SRX240H with the outgoing interface port10[], but I get the error message that the interface is not a point-to-point connection.

How can I get the two routers to communicate properly?
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Which port on Fortigate is connected to SRX240H?

Let's say you are connected as below:

SRX240[]<->Port1-[]FGT200B Portw []<->[]SERVER1

The routes should be: port1

On the router SRX24OH, you need to add.

ip route
proteus-IVAuthor Commented:
Port10[] on Fortigate is connected to port10[] on Juniper.

I tried adding the route on SRX240H, but I cannot access the subnet from the SRX240H, nor the subnet.

Here is the relevant output from the FGT200B routing table:
S [10/0] via, port10
C is directly connected, port10
C is directly connected, switch

Open in new window

And also from SRX240H:    *[Static/5] 1d 01:52:57
                              > to via ge-0/0/10.0      *[Direct/0] 1d 01:47:18
                              > via ge-0/0/1.0  *[Direct/0] 1d 01:47:18
                              > via ge-0/0/10.0  *[Local/0] 1d 01:47:31
                              > Local via ge-0/0/10.0

Open in new window

What is the gateway for PC1 and Server1?

You are not able to ping from SRX240H?

Is the ICMP allowed on Fortinet interface 10?

Can you also post traceroute from PC1 to Server1?
What were the top attacks of Q1 2018?

The Threat Lab team analyzes data from WatchGuard’s Firebox Feed, internal and partner threat intelligence, and a research honeynet, to provide insightful analysis about the top threats on the Internet. Check out our Q1 2018 report for smart, practical security advice today!

proteus-IVAuthor Commented:
PC1 gateway:
Server1 gateway:

Yes, I am unable to ping from SRX240H.

All protocols are allowed on Fortigate interface 10.

Here is the traceroute output from PC1 to Server1:

Tracing route to over a maximum of 30 hops

1  <1ms  <1ms  <1ms
2  *  *  *  Request timed out.
3  *  *  *  Request timed out.
4  *  *  *  Request timed out.
5  *  *  *  Request timed out.
6  *  *  *  Request timed out.
7  *  *  *  Request timed out.
8  *  *  *  Request timed out.
9  *  *  *  Request timed out.
10  *  *  *  Request timed out.
11  *  *  *  Request timed out.
12  *  *  *  Request timed out.
13  *  *  *  Request timed out.
14  *  *  *  Request timed out.
15  *  *  *  Request timed out.
16  *  *  *  Request timed out.
17  *  *  *  Request timed out.
18  *  *  *  Request timed out.
19  *  *  *  Request timed out.
20  *  *  *  Request timed out.
21  *  *  *  Request timed out.
22  *  *  *  Request timed out.
23  *  *  *  Request timed out.
24  *  *  *  Request timed out.
25  *  *  *  Request timed out.
26  *  *  *  Request timed out.
27  *  *  *  Request timed out.
28  *  *  *  Request timed out.
29  *  *  *  Request timed out.
30  *  *  *  Request timed out.

Trace complete.

Open in new window

There is your issue.


The connection between SRX and FGT.

Is it a direct connection or what type of connection is this?
proteus-IVAuthor Commented:
It is a direct connection, ethernet port-to-port.

But, I am able to ping from FGT200B.

I can also ping from Server1 to PC1.

Traceroute from Server1 to PC1 shows as 1st hop and as second hop and as 3rd hop.
Since you are not able to ping from SRX to the Fortgate, I think that is the issue there.

You have the correct routing so I'm curious if Fortigate is blocking incoming traffic.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.