Troubleshooting Tip: Downstream FortiGate Does Not Receive Fabric Overlay Configuration over PPPoE

Symptoms:

• The Fabric Overlay Orchestrator deployment fails on the root FortiGate.
• The downstream FortiGate does not receive the Fabric Overlay configuration.
• The logs below were observed via 'diagnose debug application csfd -1'.

The following error messages are observed in the logs:

ERR_FABRIC_VPN_PHASE1_CMDB_APPEND_ERROR
add_aps_tunnel_interface_with_ifunit: failed to create interface entry
Failed to setup Fabric VPN: Cannot append new entry to IPsec phase1 entry

Additional CMDB errors may be present:

failed to find phase1-interface.interface objid (data source=ppp2)
failed to find phase1-interface.interface objid (data source=ppp3)

From the HTTPS daemon logs:

Failed to setup Fabric VPN: ERR_FABRIC_VPN_PHASE1_CMDB_APPEND_ERROR:
Cannot append new entry to IPsec phase1 entry.

To confirm whether PPPoE is in use, run the following command on the Root FortiGate:

Example output:

FW # diagnose system csf downstream
 1: FGT40FTK24030151 (192.168.158.3) Management-IP: 192.168.158.1
 Management-port:8443 parent: FGT70FTK11224400
    path:FGT70FTK11224400:FGT40FTK11223351
    data received: Y downstream intf:Telekom upstream intf:wan2 <----- Check if this interface has PPPoE.

Conclusion:

Fabric Overlay Orchestrator does not support PPPoE interfaces.
When a PPPoE interface is used, the orchestrator cannot bind the IPsec Phase1 interface required for the overlay tunnel, which causes the Fabric Overlay deployment to fail.