Technical Tip: FGSP over FGCP asymmetric GTP UTM traffic bounce

Description

This article describes a situation where asymmetric GTP traffic traverses through an FGSP cluster where UTM inspection is needed.

Scope

FortiGate in high availability mode (FGSP/FGSP over FGCP).

Solution

• The current FGSP generic framework always follows the traffic ownership idea. In cases where the first GTP packet reached 'FGT_1', it will be responsible for further inspections regarding this session. This means that when the next packet reaches 'FGT_2' due to asymmetric routing and it needs to be inspected through IPS, 'FGT_2' will send the packet to 'FGT_1', which is called 'bounced traffic'.

• This works well in cases where there is asymmetric routing between FGSP peers. This also applies to different types of applications such as SIP.

• This behavior was introduced for the first time in FortiOS v7.0.2.

• The command 'gtp_asym_fgsp' is only to control the very first packet of the session. It will not be able to steer the traffic in any way other than the one mentioned above, so it has limited functionality and should not be depended on for other reasons.

• In some situations, these features (especially in symmetrical environments) would cause performance degradation due to the time and bandwidth consumed by bouncing the traffic back and forth. However, in FortiOS v7.6.4, UTM inspection on asymmetric traffic on L3 CLI commands were introduced to control packet bouncing as follows:

config system standalone-cluster
    set helper-traffic-bounce disable
    set utm-traffic-bounce disable
end

• As a workaround in case this is needed in earlier versions, create a session sync filter within the FGSP config to allow GTP-C tunnels to be synchronized instead of synchronizing all of the traffic. For example:

config system standalone-cluster
    set standalone-group-id 1
    set group-member-id 1
        config cluster-peer
            edit 1
                set peerip x.x.x.x
                    config session-sync-filter
                        config custom-service
                            edit 1 
                                set dst-port-range 0-2122
                            next
                            edit 2 
                                set dst-port-range 2124-65535
                            next
                        end