Skip to main content
UTM4thewin
New Member
August 7, 2017
Question

Fortigate dropping SCTP Heartbeat Requests

  • August 7, 2017
  • 0 replies
  • 2954 views

Having issues with a Fortigate policy for a sigtran M3UA association.  After troubleshooting I confirmed that the policy and route are correct in the firewall; however, it does not appear that the firewall allows SCTP Heartbeat Requests to traverse the path without first seeing the SCTP handshake containing the INIT & INIT-ACK.  While this makes sense for flow-base inspection of traffic for a connection oriented flow it is not expected for a multi-homed M3UA connection based on RFC4960 section 5.4.  The client IP address that initiates the handshake works fine however the additional multi-home IP addresses fail because the Fortigate drops the Heartbeat requests that are used to verify the path for the other IP addresses in the M3UA association.  

 

HW: Fortigate 300D

OS: FortiOS 5.4