Fortigate dropping SCTP Heartbeat Requests
Having issues with a Fortigate policy for a sigtran M3UA association. After troubleshooting I confirmed that the policy and route are correct in the firewall; however, it does not appear that the firewall allows SCTP Heartbeat Requests to traverse the path without first seeing the SCTP handshake containing the INIT & INIT-ACK. While this makes sense for flow-base inspection of traffic for a connection oriented flow it is not expected for a multi-homed M3UA connection based on RFC4960 section 5.4. The client IP address that initiates the handshake works fine however the additional multi-home IP addresses fail because the Fortigate drops the Heartbeat requests that are used to verify the path for the other IP addresses in the M3UA association.
HW: Fortigate 300D
OS: FortiOS 5.4
