Troubleshooting: Routing issue with FortiGate on Oracle Cloud Infrastructure (OCI)

The FortiGate OCI instance will add a kernel route '0.0.0.0/0 via port1' when using an ISCSI boot volume. Because of this route, the traffic will be forwarded via the port1 interface instead of the intended internet interface, taking precedence over the configured default route.

Example kernel route output:

get router info kernel

tab=65534 vf=0 vrf=0 scope=0 type=1 proto=18 prio=0 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0 gwy=10.0.24.1 dev=3(port1)

Example routing table output:

get router info routing-table all

Routing table for VRF=0
S* 0.0.0.0/0 [5/0] via 10.110.2.1, port3, [1/0] <----- Despite the routing table default route pointing towards port 3.
S 10.112.2.0/24 [10/0] via 10.110.1.1, port2, [1/0]

To resolve this issue, follow these steps:

Workaround:

1. Check the launch options of the FortiGate instance and change the boot volume to PARAVIRTUALIZED if possible.
2. If the ISCSI mode is required, add a new static route to point to the ISCSI connection endpoint via port1 using the following command: 

config router static 

    edit 1 

        set dst 169.254.0.0 255.255.0.0 

        set gateway <Gateway IP> 

        set device "port1" 

    next

end

3. After, delete the extra default route in the kernel table via port1 using the following command:

diagnose ip route delete port1 0.0.0.0 0.0.0.0 <gateway> <distance> <priority>

For a permanent fix, it is necessary to upgrade the FortiGate firmware version to v7.6.7, v8.0.0, or above.

Refer to the following article for more information on configuring FortiGate on OCI: About FortiGate-VM for OCI.