Skip to main content
aguerriero
aguerriero
Explorer
February 26, 2024
Question

FortiOS 7.4.3 incorrect interface utilization for SNMP on ipsec interfaces

  • February 26, 2024
  • 3 replies
  • 4047 views

fortiAfter upgrading to 7.4.3 my 1100E is doing something wrong when answering requests for ifoutoctets on ipsec interfaces.

Occassionaly Delta for out octets is way too high which shows an ipsec tunnel on a 40Gig interface at 90+ percent utilization while the physical 40Gig interface is reporting correctly.

 

 

3 replies

Kangming
Staff
Kangming
Staff
February 26, 2024

Hi 

What model of device are you using?
Can you provide a screenshot? Is there any SNMP OID information?

aguerriero
aguerrieroAuthor
Explorer
February 26, 2024

The device is an 1100E. Physical interface is 4x 10gbe interfaces as an aggregate. The tunnel uses that interface as a source.

This is the MIB being monitored right after clearing the counters on the interfaces. Eventually there will be major spikes in the tx octets along with my snmp management system issuing an alert for utilization above 90 percent.

Doing another poll directly for the ifoutoctet mib will show considerably more octets transmitted out of the tunnel than across the physical interface.

This has run fine for the last 3-4 years and it has only started happening right after upgrade to 7.4.3.

Index 73 is the physical interface. Index 56 is the ipsec interface.

Captureinitial.PNG

 

Kangming
Staff
Kangming
Staff
February 27, 2024

Thanks for your feedback.

 

If you can share your configuration file, I will be able to reproduce it in the lab. If it can be reproduced and confirmed to be an issue, I will submit the bug to Dev for investigation, my email is: kmliu@fortinet.com, thanks!

    aguerriero
    aguerrieroAuthor
    Explorer
    March 21, 2024

    I downgraded to 7.2.8... it is back to working like it should. Next stop...

    CatInHat
    CatInHat
    Explorer
    March 21, 2024

    This results in the delta for outgoing octets sometimes being too large, causing IPsec tunnel load to be reported incorrectly on 40Gig interfaces while the 40Gig physical interface is reporting correct data

    Terms & ConditionsAccessibility statement