New Member

Question

GRE Tunel not working after 7.4.1 > 7.4.3

Forum|Forum|2 years ago
February 10, 2024
36 replies
16147 views

Hi

My GRE tunel connection is not working after upgrade FortiOS from 7.4.1 > 7.4.3.

Forti shows, that connection is UP but I have no access to network.

Checked policies, diagnosed connection and everything looks fine.

Any idea what to check next? How to monitor?

Best regards,

Rafal

FortiGate

rtanagras

Staff & Editor

Hi @Rafal - You can try disabling "np-acceleration" and "auto-asic-offloading" to troubleshoot the issue. Additionally, examining the sniffer output and using the debug flow command can provide more insights.

Hong_FTNT

Staff & Editor

Hi @itc,

Are you using NAT? Are there any IP pools/VIPs related to local/remote subnets of the GRE tunnel? There was a behavior change on the new version which might cause the issue. Please refer to https://community.fortinet.com/t5/FortiGate/Technical-Tip-IP-pool-behavior-Change-in-default-ippool/ta-p/196277

Regards,

infor1

New Member

I have the same problem. Have you solved the problem?

AEK

SuperUser

Try follow @rtanagras and @hbac suggestions.

AEK

infor1

New Member

I used it, but it helped. I had to go back to the old firmware. The old one works ok.

in log knowledge this :
anti-spoof check failed,drop

Deltaman

New Member

Hi,

I have the same issue and have made a case.

GRE Tunnel not working after 7.4.1 > 7.4.2 or 7.4.3. Roll back solves the issue

With diagnose sniffer I can see that traffic is only inbound and not outbound. Interfaces show status up, but traffic is not encapsulated when needs to go outbound.

Also I have seen that the route for data that should travel through the GRE tunnel is not installed when running firmware 7.4.2 or 7.4.3.

Regards,

Hugo

AEK

SuperUser

Hi Hugo

That's interesting info.

Did you try manually install the missing route to see if it fixes the issue?

AEK

Deltaman

New Member

Yes I did, but the routes does then also not get installed, then you would think that the interface is not up what causes the route to be not installed.

But GUI displayes as interfaces are all up.

itcAuthor

New Member

After lamost 7h with Fortinet Suppoert on hands in my case none of above worked and end-up with conclusion: bug moved to Enginers to wrok it out, and meanwhile downgrade to 7.4.1.:

------------------------------------

anti-spoof check failed,drop

------------------------------------

Log entry causes problems and no one have any idea, for now, WHY.

Wait.. Fortinet: We are developing 7.4.4 - wait...

No solution for this so far...

If any changes came up, I will let You all know.

Best regards

AEK

SuperUser

@itc, thanks for sharing

anti-spoof check fail should mean FG has no route back to the sending IP. This consolidates @Deltaman 's observation that GRE route not added to routing table.

In that case, adding manually the route should be a good workaround.

AEK