Troubleshooting Tip: FortiGate-VM stop forwarding the traffic

FortiGate deployed in the VM/Cloud platform stops forwarding the traffic event with a valid policy, and route, and an ARP entry is present in the device.

Scenario:

FortiGate-VM is deployed in VMware and is a working setup.

Policy:

config firewall policy
    edit 1
        set uuid 7f54d090-f2f5-51ef-85b7-eeeafede0801
        set srcintf "any"
        set dstintf "any"
        set srcaddr "all"
        set dstaddr "all"
        set schedule "always"
        set service "ALL"
    next
end

Route:

InternalFGT1 # get router info routing-table details 10.10.1.0

Routing table for VRF=0
Routing entry for 10.10.1.0/24
Known via "bgp", distance 200, metric 0, best
Last update 00:40:04 ago
* vrf 0 192.168.1.1 priority 1 (recursive is directly connected, port1)

ARP table:

InternalFGT1 # get sys arp
Address Age(min) Hardware Addr Interface
192.168.1.3 0 aa:bb:cc:00:03:10 port1
192.168.1.1 0 aa:bb:cc:00:01:00 port1

Flow filter debug of a non-working communication shows the below information only:

InternalFGT1 # id=65308 trace_id=6 func=print_pkt_detail line=5920 msg="vd-root:0 received a packet(proto=1, 192.168.1.3:1->10.10.1.1:2048) tun_id=0.0.0.0 from port1. type=8, code=0, id=1, seq=0."
id=65308 trace_id=6 func=init_ip_session_common line=6110 msg="allocate a new session-00000475"
id=65308 trace_id=6 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=00000000 gw-192.168.1.1 via port1"

Debug does not give information about policy matches and outgoing traffic information. Sniffer also shows only an ingress packet and no sign of an egress packet

InternalFGT1 # dia sniffer packet any "icmp" 4 0 l
Using Original Sniffing Mode
interfaces=[any]
filters=[icmp]
2025-02-24 13:29:23.712696 port1 in 192.168.1.3 -> 10.10.1.1: icmp: echo request
2025-02-24 13:29:25.716703 port1 in 192.168.1.3 -> 10.10.1.1: icmp: echo request
2025-02-24 13:29:27.717955 port1 in 192.168.1.3 -> 10.10.1.1: icmp: echo request
2025-02-24 13:29:29.717552 port1 in 192.168.1.3 -> 10.10.1.1: icmp: echo request
2025-02-24 13:29:31.719701 port1 in 192.168.1.3 -> 10.10.1.1: icmp: echo request
^C
5 packets received by filter
0 packets dropped by kernel

A capture can also be taken from the GUI: see Using the packet capture tool.

This behavior is observed when the FortiGate-VM license has changed to 'invalid' due to lost connectivity to the Fortiguard server/FortiManager for license validation.

To find the status of the licesne on VM, run the following CLI command:

get system status
Version: FortiGate-VM64-KVM v7.4.8,build2795,200730 (GA)
...
Serial-Number: FGVM08**********
....
License Status: Invalid
VM Resources: 1 CPU/8 allowed, 2010 MB RAM
...

For more information on VM license: VM license.

Related article:

Technical Tip: FortiGate-VM License management, validation, and troubleshooting