| Description | This article describes an issue where packet communication from remote to local is dropped when configuring the Secure Private Access (SPA) service on FortiSASE. This configuration assumes that both BGP and Healthcheck are enabled between the FortiSASE and FortiGate Hub. It occurs during debug flow when accessing an internal local server from a remote through Secure Private Access (SPA): 2026-01-15 12:47:59 id=65308 trace_id=1460 func=print_pkt_detail line=5813 msg="vd-root:0 received a packet(proto=1, 100.65.96.2:1->172.168.80.3:2048) tun_id=10.0.10.12 from fgt_hub_kr. type=8, code=0, id=1, seq=1992."
2026-01-15 12:47:59 id=65308 trace_id=1460 func=ipsec_spoofed4 line=243 msg="src ip 100.65.96.2 match selector 0 range 0.0.0.0-255.255.255.255"
2026-01-15 12:47:59 id=65308 trace_id=1460 func=init_ip_session_common line=5997 msg="allocate a new session-001085b8"
2026-01-15 12:47:59 id=65308 trace_id=1460 func=iprope_dnat_check line=5276 msg="in-[fgt_hub_kr], out-[]"
2026-01-15 12:47:59 id=65308 trace_id=1460 func=iprope_dnat_tree_check line=834 msg="len=0"
2026-01-15 12:47:59 id=65308 trace_id=1460 func=iprope_dnat_check line=5288 msg="result: skb_flags-02000008, vid-0, ret-no-match, act-accept, flag-00000000"
2026-01-15 12:47:59 id=65308 trace_id=1460 func=ip_route_input_slow line=2267 msg="reverse path check fail, drop"
2026-01-15 12:47:59 id=65308 trace_id=1460 func=ip_session_handle_no_dst line=6083 msg="trace" When checking the routing table for source IP 100.65.96.2 in FortiGate Hub, It is confirmed that it is Port17 and not a tunnel interface. get router info routing-table details 100.65.96.2 Routing table for VRF=0
Routing entry for 0.0.0.0/0
Known via "static", distance 10, metric 0, best
* vrf 0 x.x.x.x, via port17 <-- |
| Solution | To resolve this problem, add destination routing so that this source (100.65.96.2) can apply the tunnel interface. get router info routing-table details
S 100.65.96.0/24 [10/0] is directly connected, fgt_hub_kr, [1/0] get router info routing-table details 100.65.96.2 Routing table for VRF=0
Routing entry for 100.65.96.0/24
Known via "static", distance 10, metric 0, best
* directly connected, fgt_hub_kr << A remote user can access the internal server through Secure Private Access (SPA): 2026-01-15 12:52:40 id=65308 trace_id=1555 func=print_pkt_detail line=5813 msg="vd-root:0 received a packet(proto=1, 100.65.96.2:1->172.168.80.3:2048) tun_id=10.0.10.12 from fgt_hub_kr. type=8, code=0, id=1, seq=2123."
2026-01-15 12:52:40 id=65308 trace_id=1555 func=ipsec_spoofed4 line=243 msg="src ip 100.65.96.2 match selector 0 range 0.0.0.0-255.255.255.255"
2026-01-15 12:52:40 id=65308 trace_id=1555 func=init_ip_session_common line=5997 msg="allocate a new session-00108ba8"
2026-01-15 12:52:40 id=65308 trace_id=1555 func=iprope_dnat_check line=5276 msg="in-[fgt_hub_kr], out-[]"
2026-01-15 12:52:40 id=65308 trace_id=1555 func=iprope_dnat_tree_check line=834 msg="len=0"
2026-01-15 12:52:40 id=65308 trace_id=1555 func=iprope_dnat_check line=5288 msg="result: skb_flags-02000008, vid-0, ret-no-match, act-accept, flag-00000000"
2026-01-15 12:52:40 id=65308 trace_id=1555 func=vf_ip_route_input_common line=2611 msg="find a route: flag=04000000 gw-172.168.80.3 via VL80"
2026-01-15 12:52:40 id=65308 trace_id=1555 func=iprope_fwd_check line=766 msg="in-[fgt_hub_kr], out-[VL80], skb_flags-02000008, vid-0, app_id: 0, url_cat_id: 0"
2026-01-15 12:52:40 id=65308 trace_id=1555 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=124, len=2"
2026-01-15 12:52:40 id=65308 trace_id=1555 func=__iprope_check_one_policy line=2025 msg="checked gnum-100004 policy-7, ret-matched, act-accept"
2026-01-15 12:52:40 id=65308 trace_id=1555 func=__iprope_user_identity_check line=1799 msg="ret-matched"
2026-01-15 12:52:40 id=65308 trace_id=1555 func=__iprope_check line=2273 msg="gnum-4e20, check-ffffffffa002f580"
2026-01-15 12:52:40 id=65308 trace_id=1555 func=__iprope_check_one_policy line=2025 msg="checked gnum-4e20 policy-6,ret-no-match, act-accept"
2026-01-15 12:52:40 id=65308 trace_id=1555 func=__iprope_check_one_policy line=2025 msg="checked gnum-4e20 policy-6,ret-no-match, act-accept"
2026-01-15 12:52:40 id=65308 trace_id=1555 func=__iprope_check_one_policy line=2025 msg="checked gnum-4e20 policy-6,ret-no-match, act-accept"
2026-01-15 12:52:40 id=65308 trace_id=1555 func=__iprope_check line=2290 msg="gnum-4e20 check result: ret-no-match, act-accept, flag-00000000, flag2-00000000"
2026-01-15 12:52:40 id=65308 trace_id=1555 func=__iprope_check_one_policy line=2243 msg="policy-7 is matched, act-accept"
2026-01-15 12:52:40 id=65308 trace_id=1555 func=iprope_fwd_check line=803 msg="after iprope_captive_check(): is_captive-0, ret-matched, act-accept, idx-7"
2026-01-15 12:52:40 id=65308 trace_id=1555 func=iprope_fwd_auth_check line=822 msg="after iprope_captive_check(): is_captive-0, ret-matched, act-accept, idx-7"
2026-01-15 12:52:40 id=65308 trace_id=1555 func=fw_forward_handler line=980 msg="Allowed by Policy-7:" |
