Troubleshooting Tip: OCI SDN connector showing down

Description

This article describes the issue where the OCI SDN connector shows as down on the FortiGate.

Scope

FortiGate-VM deployed in Oracle Cloud Infrastructure (OCI).

Solution

In the following image, the OCI SDN Connector shows as down:

Run the following commands:

diagnose debug disable
diagnose debug reset
diagnose debug console timestamp enable
diagnose debug application ocid -1
diagnose debug enable

Disable and re-enable the OCI SDN connector to reproduce the issue, and stop the debug after reproducing the issue:

diagnose debug disable
diagnose debug reset

The debug may show the following error:

ocid getting instance metadatametadata url: http://169.254.169.254/opc/v2/instance/
curl resp: 404, error buf:
curl err: <html>
<head><title>404 Not Found</title></head>
<body bgcolor="white">
<center><h1>404 Not Found</h1></center>
</body>
</html>
st diskte
command_cli_diag:5908 no attribute input.
Command fail. Return code -61

This error may indicate that FortiGate-VM cannot access the OCI Instance Metadata Service.

Check connectivity to the metadata service:

execute ping 169.254.169.254

Check the route used to reach the metadata service:

get router info routing-table details 169.254.169.254

The route must use port1, which is the FortiGate-VM interface associated with the OCI primary VNIC. If the route uses another interface, configure a static route to 169.254.169.254 through port1.

Afterward, the OCI SDN connector will come up.

If needed, restart the ocid daemon by running the following command: 

diagnose test application ocid 99

The following ocid diagnostic options are available:

diagnose test application ocid <option>
1. Show HA statistics
2. Run the SDN API test
3. Run the HA API test
4. Run the filter list test
99. Restart the ocid daemon