Technical Tip: Client unable to ping FortiADC connected to FortiSwitch

Description

This article describes an issue where clients are unable to ping a FortiADC connected to a FortiSwitch (topology configured with MCLAG-ICL and VRRP).

Scope

FortiSwitch, FortiADC.

Solution

Topology:

In this topology, FortiSwitch1 and FortiSwitch2 are configured as an MCLAG-ICL pair with VRRP enabled.

FortiSwitch3 is dual-homed to the MCLAG pair, and FortiADC is connected to FortiSwitch3. The FortiADC uses the VRRP virtual IP address as its default gateway.

Observation:

1. The ARP table on the FortiADC contains both:

• The VRRP virtual IP and virtual MAC address.

• The physical switch IP address and switch MAC address.

2. When the FortiADC sends an ICMP request to a destination in another subnet, the packet is forwarded using the VRRP virtual MAC address as the destination MAC address. This behavior is expected and functions correctly.

3. However, when the FortiADC sends an ICMP reply, it uses the physical switch MAC address instead of the VRRP virtual MAC address as the destination MAC address.

4. This behavior disrupts MCLAG routing because both FortiSwitches participating in the MCLAG domain expect traffic destined for the default gateway to use the VRRP virtual MAC address. As a result, ICMP reply traffic may not be forwarded correctly.

Cause:

1. This behavior is caused by the FortiADC reverse route cache feature, which is enabled by default.

2. The reverse route cache mechanism is designed to prevent asymmetric routing. When enabled, return traffic uses the source MAC address from the incoming packet as the destination MAC address for the outgoing packet.

3. Since the ICMP request originates from a FortiSwitch using its physical switch MAC address, the FortiADC learns this MAC address through the reverse route cache. Consequently, the ICMP reply is transmitted using the physical switch MAC address as the destination MAC address instead of the VRRP virtual MAC address.

This behavior is expected when reverse route cache is enabled.

Resolution:

Disable the reverse route cache feature on the FortiADC. This causes return traffic to use normal routing behavior and the VRRP virtual MAC address. However, disabling this feature may introduce asymmetric routing in some deployments.

FortiADC# show full router setting
    config router setting
        set rt-cache-strict disable
        set rt-cache-reverse enable
        set virtual-server-l2-cache-timeout 0
        set rt-best-match disable
        set ip-forward enable
        set ip6-forward enable
        set icmp-redirect-send disable
        set ip-forward-use-pmtu disable
        set layer4-vs-ignore-df disable
            config rt-cache-reverse-exception
            end
        end

The following setting enables the reverse route cache feature:

set rt-cache-reverse enable