Solution | Starting from FortiOS versions 7.2.12 and 7.4.2, FortiOS performs an anti-spoofing check against source and destination IP addresses and strictly controls whether the phase 2 selectors and SPI are correct for the source and destination IP addresses. Â
However, this can cause RX errors on the tunnel interface if any ICMP messages are generated by the remote peer, since the remote peer would use its own tunnel IP address and the same SPI, which may not be included in the Phase 2 Selector, for ICMP response messages.
This article shows an example scenario and how peers behave if attempt is made to access a nonexistent remote host.
Tunnel info from the HUB:
FortiGate_HUB # fnsysctl ifconfig VPN1
VPN1 Link encap:Unknown
inet addr:192.168.168.254 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1420 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0 Bytes) TX bytes:0 (0 Bytes)
FortiGate_HUB # diagnose vpn tunnel list
list all ipsec tunnel in vd 0
------------------------------------------------------
name=VPN1_0 ver=1 serial=2 172.16.1.1:0->172.16.1.254:0 nexthop=0.0.0.0 tun_id=172.16.1.254 tun_id6=::10.0.0.2 status=up dst_mtu=1500 weight=1
bound_if=4 real_if=4 lgwy=static/1 tun=intf mode=dial_inst/3 encap=none/74408 options[122a8]=npu rgwy-chg frag-rfc run_state=0 role=primary accept_traffic=1 overlay_i
d=0
parent=VPN1 index=0
proxyid_num=2 child_num=0 refcnt=6 ilast=99 olast=99 ad=/0
stat: rxp=5 txp=5 rxb=420 txb=420
dpd: mode=on-idle on=1 status=ok idle=60000ms retry=3 count=0 seqno=190
natt: mode=none draft=0 interval=0 remote_port=0
fec: egress=0 ingress=0
proxyid=VPN1 proto=0 sa=1 ref=2 serial=1 add-route
src: 0:0.0.0.0-255.255.255.255:0
dst: 0:192.168.1.0-192.168.1.255:0
SA: ref=3 options=20282 type=00 soft=0 mtu=1438 expire=43023/0B replaywin=2048
seqno=6 esn=0 replaywin_lastseq=00000006 qat=0 rekey=0 hash_search_len=1
life: type=01 bytes=0/0 timeout=43189/43200
dec: spi=0da84216 esp=aes key=16 5c46ce26632a484e76b2e68f6ffa5889
ah=sha1 key=20 5d15fdb3b0f989531279e1be6158497b2ff83ba2
enc: spi=6b228ee6 esp=aes key=16 fa8e1f0efac1d4edf00a0c39c933b9b3
ah=sha1 key=20 c7b88001d26e6e5ccfd8ca96af8352e33dc265c9
dec:pkts/bytes=5/420, enc:pkts/bytes=5/760
npu_flag=00 npu_lgwy=0.0.0.0:0 npu_rgwy=0.0.0.0:0
npu_selid=0 dec_npuid=0 enc_npuid=0
proxyid=VPN1 proto=0 sa=1 ref=2 serial=2 add-route
src: 0:0.0.0.0-255.255.255.255:0
dst: 0:192.168.168.0-192.168.168.255:0
SA: ref=3 options=20282 type=00 soft=0 mtu=1438 expire=43019/0B replaywin=2048
seqno=1 esn=0 replaywin_lastseq=00000000 qat=0 rekey=0 hash_search_len=1
life: type=01 bytes=0/0 timeout=43185/43200
dec: spi=0da84217 esp=aes key=16 2f4f7f03c890a99bca12db4355010db0
ah=sha1 key=20 16f45104054174c368d9361734a81ba7cf37ac1f
enc: spi=6b228ee7 esp=aes key=16 1c5f2c8cff086ed861e97da7a9422f68
ah=sha1 key=20 5755a613888317d916b4d54d393da1de8ebb43ff
dec:pkts/bytes=0/0, enc:pkts/bytes=0/0
npu_flag=00 npu_lgwy=0.0.0.0:0 npu_rgwy=0.0.0.0:0
npu_selid=1 dec_npuid=0 enc_npuid=0
------------------------------------------------------
name=VPN1 ver=1 serial=1 172.16.1.1:0->0.0.0.0:0 nexthop=0.0.0.0 tun_id=10.0.0.1 tun_id6=::10.0.0.1 status=up dst_mtu=0 weight=1
bound_if=4 real_if=0 lgwy=static/1 tun=intf mode=dialup/2 encap=none/552 options[0228]=npu frag-rfc role=primary accept_traffic=1 overlay_id=0
proxyid_num=0 child_num=1 refcnt=3 ilast=42963083 olast=42963083 ad=/0
stat: rxp=5 txp=5 rxb=420 txb=420
dpd: mode=on-idle on=0 status=ok idle=60000ms retry=3 count=0 seqno=0
natt: mode=none draft=0 interval=0 remote_port=0
fec: egress=0 ingress=0
If a local host attempts to connect to an IP address that is not reachable from the remote peer, the peer would generate an ICMP unreachable message with its relevant IP address, which might not be in the phase 2 selector.
Debug flow output on the HUB:
id=65308 trace_id=11 func=print_pkt_detail line=6005 msg="vd-root:0 received a packet(proto=1, 10.0.0.1:35->192.168.1.2:2048) tun_id=0.0.0.0 from port3
. type=8, code=0, id=35, seq=0."
id=65308 trace_id=11 func=init_ip_session_common line=6206 msg="allocate a new session-00000ca3"
id=65308 trace_id=11 func=iprope_dnat_check line=5487 msg="in-[port3], out-[]"
id=65308 trace_id=11 func=iprope_dnat_tree_check line=824 msg="len=0"
id=65308 trace_id=11 func=iprope_dnat_check line=5512 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
id=65308 trace_id=11 func=__vf_ip_route_input_rcu line=1989 msg="find a route: flag=00000000 gw-172.16.1.254 via VPN1"
id=65308 trace_id=11 func=__iprope_fwd_check line=809 msg="in-[port3], out-[VPN1], skb_flags-02000000, vid-0, app_id: 0, url_cat_id: 0"
id=65308 trace_id=11 func=__iprope_tree_check line=535 msg="gnum-100004, use addr/intf hash, len=2"
id=65308 trace_id=11 func=__iprope_check_one_policy line=2146 msg="checked gnum-100004 policy-1, ret-matched, act-accept"
id=65308 trace_id=11 func=__iprope_user_identity_check line=1909 msg="ret-matched"
id=65308 trace_id=11 func=__iprope_check line=2410 msg="gnum-4e20, check-ffffffffa002cbbf"
id=65308 trace_id=11 func=__iprope_check_one_policy line=2146 msg="checked gnum-4e20 policy-6, ret-no-match, act-accept"
id=65308 trace_id=11 func=__iprope_check_one_policy line=2146 msg="checked gnum-4e20 policy-6, ret-no-match, act-accept"
id=65308 trace_id=11 func=__iprope_check_one_policy line=2146 msg="checked gnum-4e20 policy-6, ret-no-match, act-accept"
id=65308 trace_id=11 func=__iprope_check line=2427 msg="gnum-4e20 check result: ret-no-match, act-accept, flag-00000000, flag2-00000000"
id=65308 trace_id=11 func=__iprope_check_one_policy line=2380 msg="policy-1 is matched, act-accept"
id=65308 trace_id=11 func=__iprope_fwd_check line=846 msg="after iprope_captive_check(): is_captive-0, ret-matched, act-accept, idx-1"
id=65308 trace_id=11 func=iprope_fwd_auth_check line=875 msg="after iprope_captive_check(): is_captive-0, ret-matched, act-accept, idx-1"
id=65308 trace_id=11 func=fw_forward_handler line=1002 msg="Allowed by Policy-1:"
id=65308 trace_id=11 func=ip_session_confirm_final line=3179 msg="npu_state=0x100, hook=4"
id=65308 trace_id=11 func=ipsecdev_hard_start_xmit line=662 msg="enter IPSec interface VPN1, tun_id=0.0.0.0"
id=65308 trace_id=11 func=_do_ipsecdev_hard_start_xmit line=222 msg="output to IPSec tunnel VPN1_0, tun_id=172.16.1.254, vrf 0"
id=65308 trace_id=11 func=esp_output4 line=917 msg="IPsec encrypt/auth"
id=65308 trace_id=11 func=nipsec_set_ipsec_sa_enc line=952 msg="Trying to offload IPsec encrypt SA (p1/p2/spi={VPN1_0/VPN1/0x6b228ee6}), npudev=-1, skb-dev=port2"
id=65308 trace_id=11 func=nipsec_set_ipsec_sa_enc line=1001 msg="IPSec encrypt SA (p1/p2/spi={VPN1_0/VPN1/0x6b228ee6}) offloading-check failed, reason_code=2."
id=65308 trace_id=11 func=ipsec_output_finish line=677 msg="send to 0.0.0.0 via intf-port2"
….
id=65308 trace_id=15 func=print_pkt_detail line=6005 msg="vd-root:0 received a packet(proto=1, 192.168.168.1:0->10.0.0.1:769) tun_id=172.16.1.254 from VPN1. type=3, co
de=1, id=0, seq=0."
id=65308 trace_id=15 func=ipsec_spoofed4 line=243 msg="src ip 192.168.168.1 mismatch selector 0 range 192.168.1.0-192.168.1.255"
id=65308 trace_id=15 func=ipsec_input4 line=287 msg="anti-spoof check failed, drop"
id=65308 trace_id=16 func=print_pkt_detail line=6005 msg="vd-root:0 received a packet(proto=1, 192.168.168.1:0->10.0.0.1:769) tun_id=172.16.1.254 from VPN1. type=3, co
de=1, id=0, seq=0."
Packet capture also shows the source IP is not for this phase 2 selector:
As a result, the HUB drops the packets.
This issue is caused by the remote peer trying to use the original phase 2 selector for ICMP responses, even though it should use the other selector with SPI 0da84217 and has been addressed in FortiOS versions 7.4.12 and 7.6.7.
Related articles:
|
