Skip to main content
ArkadyK
New Member
February 9, 2026
Solved

Some interfaces allow only 2 pings

  • February 9, 2026
  • 3 replies
  • 494 views

Hello All!
On my FG 90 strange issue - after restart on some interfaces traffic partially dropped.

For example - from my computer (VLAN 10) I am trying to ping server located in VLAN 22:
 

C:\Windows\System32>ping 192.168.22.1

Pinging 192.168.22.1 with 32 bytes of data:
Reply from 192.168.22.1: bytes=32 time<1ms TTL=63
Reply from 192.168.22.1: bytes=32 time=1ms TTL=63
Request timed out.
Request timed out.

Ping statistics for 192.168.22.1:
Packets: Sent = 4, Received = 2, Lost = 2 (50% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms

 

In previous firmware one more restart was solve it. But after upgrade to 7.4.11 even after restart the issue stil exists on few interfaces.

 

Here is an output of sniffer:

diag sniffer packet any 'host 192.168.22.1 and host 192.168.10.51' 1 100
interfaces=[any]
filters=[host 192.168.22.1 and host 192.168.10.51]
6.892452 192.168.10.51 -> 192.168.22.1: icmp: echo request
6.892478 192.168.10.51 -> 192.168.22.1: icmp: echo request
6.892480 192.168.10.51 -> 192.168.22.1: icmp: echo request
6.892482 192.168.10.51 -> 192.168.22.1: icmp: echo request
6.892810 192.168.22.1 -> 192.168.10.51: icmp: echo reply
6.892818 192.168.22.1 -> 192.168.10.51: icmp: echo reply
6.892819 192.168.22.1 -> 192.168.10.51: icmp: echo reply
6.892820 192.168.22.1 -> 192.168.10.51: icmp: echo reply
7.903519 192.168.10.51 -> 192.168.22.1: icmp: echo request
7.903536 192.168.10.51 -> 192.168.22.1: icmp: echo request
7.903538 192.168.10.51 -> 192.168.22.1: icmp: echo request
7.903540 192.168.10.51 -> 192.168.22.1: icmp: echo request
7.903940 192.168.22.1 -> 192.168.10.51: icmp: echo reply
7.903952 192.168.22.1 -> 192.168.10.51: icmp: echo reply
7.903954 192.168.22.1 -> 192.168.10.51: icmp: echo reply
7.903955 192.168.22.1 -> 192.168.10.51: icmp: echo reply

 

I already tried to delete the interface and created it again. It's doesn't help.

 

Any ideas?

Best answer by BillH_FTNT

Hi @ArkadyK 

1. Could you disable NPU offload under policy 245  then check ?

config firewall policy
edit 245

set auto-asic-offload disable

end

2. Could you share your full cfg to my email bhoang@fortinet.com ? I am Bill from Fortinet ; or if you have ticket please upload the CFG in the ticket. I need to reproduce the issue with same cfg with you. Thank you

3. Can you verify the traffic flow and topology ?

 

traffic flow.png

 

3 replies

Toshi_Esumi
SuperUser
SuperUser
February 9, 2026

That means the 3rd ping and after are off-loaded to NPU. If you want to see all of them in sniffing, you need to disable offloading at a matching policy.
  set auto-asic-offload disable

https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-Disable-Hardware-Acceleration/ta-p/191256

Toshi

BillH_FTNT
Staff
Staff
February 9, 2026

Hi @ArkadyK 

what is the device version ? topology and policy ? Could you share these information ?

Thank you

Bill

ArkadyK
ArkadyKAuthor
New Member
February 9, 2026

It is 90G 7.4.11, but the problem was on previous firmware versions as well.
Both mentioned VLANs are interfaces of type VLAN, created on physical interface LAN, which is Redundant Interface contains 2 members - port1 and port2.

Here is a FW policy:
config firewall policy
edit 245
set name "TestComp --> Monitors"
set uuid 1801a2ba-05c8-51f1-9879-df39d2ced057
set srcintf "10"
set dstintf "22 VLAN"
set action accept
set srcaddr "TestComp"
set dstaddr "Monitor"
set schedule "always"
set service "PING" "SSH" "Web Access"
set logtraffic all
next
end

 

As you can see there is no SSL inspection.

Interface LAN contains a lot of VLAN interfaces and traffic between them flowing as expected. But some 3 of them dropping connectivity.

BillH_FTNT
Staff
Staff
February 9, 2026

Hi @ArkadyK 

1. Could you disable NPU offload under policy 245  then check ?

config firewall policy
edit 245

set auto-asic-offload disable

end

2. Could you share your full cfg to my email bhoang@fortinet.com ? I am Bill from Fortinet ; or if you have ticket please upload the CFG in the ticket. I need to reproduce the issue with same cfg with you. Thank you

3. Can you verify the traffic flow and topology ?

 

traffic flow.png

 

ArkadyK
ArkadyKAuthor
New Member
February 10, 2026

Thank you for all, who tried to help!

Finally, I called Fortinet support, and they find a way to fix the issue:

We should find a policy that cut a connectivity and through CLI:

set auto-asic-offload disable