Question
Odd " reverse path check fail, drop" , no ICMP replies from interface
Hello, I am having a strange issue that when I ping the interface of the firewall, I do not receive an echo reply (" PING" to the interface is enabled). Tracing the flow, I see the following message: " reverse path check fail, drop" Performing some research, I saw this KB: http://kb.fortinet.com/kb/documentLink.do?popup=true&externalID=FD30543 This is not the case at all: My host is 192.168.20.20, the firewall interface is 192.168.20.1. I do have restrictive firewall policies in place, specifically to deny anything across the firewall incoming on the port, but not to the port. Why would this be occurring? Thanks, Matt [edit] Found the issue :D # get router info routing-table all C 192.168.20.1/32 is directly connected, internal2 Apparently, something isn' t configured correctly... [edit 2] The netmask of the interface was configured as /32, it should have been /24. # get router info routing-table all C 192.168.20.0/24 is directly connected, internal2
[edit 3] Now I' m getting " iprope_in_check() check failed, drop" http://kb.fortinet.com/kb/microsites/microsite.do?cmd=displayKC&externalId=FD31702 PING enabled on interface: Yes Ingress host match: Yes Traversing firewall interfaces: No hmmm.....
[edit 3] Now I' m getting " iprope_in_check() check failed, drop" http://kb.fortinet.com/kb/microsites/microsite.do?cmd=displayKC&externalId=FD31702 PING enabled on interface: Yes Ingress host match: Yes Traversing firewall interfaces: No hmmm.....