Fortigate replies to ICMP even though the best route is out another interface.
Hello guys,
This is my first post here and wanted to clarify something in my head about the way Fortigate processes traffic.
I have the following topology. R1 ---- FGT ----R2 + this configuration:
-R1 and R2 both have 9.9.9.9/32 configured as Loopback interfaces.
-FGT has 1.1.1.1/32 configured as Loopback interface
-R1 has static route towards 1.1.1.1 via FGT
-R2 has default route via FGT
-FGT has default route via R1 and static route to 9.9.9.9 via R2.
If I try to ping 1.1.1.1, it works from both R1 and R2. I find that odd, given the fact that the best route towards 9.9.9.9 is via R2.
The only thing I could think is regarding the fact that when pinging from R1 (the one that should not work from my point of view), the FGT because it has loose RPF configured, it allows the traffic on that port and then when replying it does not consult the routing table and rather it sends the reply via the interface it received it. Can I have a confirmation about this behavior?
BR,
Radu
