Skip to main content
kallbrandt
kallbrandt
New Member
March 9, 2018
Question

VIP/IP-Pools stops working - ARP issue? 800C HA, A-A, 5.2.13

  • March 9, 2018
  • 1 reply
  • 23942 views

Hello,

An odd error - A lot of services suddenly went offline yesterday evening at a client's datacenter. Almost nothing regarding NAT worked. Most of the VIPs was dead - The logs are empty! No traffic! (Lots of users, webpages etc. Incoming traffic 24/7.) Failing over to other fw makes it work for a while. Same with reboots. Editing the VIP, like changing the public IP and then save might make it work for a while. The same with IP-Pools - Changing the pool in any way makes it work, for a while. The only outgoing NAT that actually works all the time is the interface address. All virtual addresses are totally unreliable. No strange traffic or load of any kind.

 

ISP has no problems with routing, the prefixes are advertised, and we did a failover to backup router (VRRP/BGP) that's located in another DC - Same problem. Other vdoms has internet access and SNAT/DNAT also, and works. Other equipment (VPN-concentrator etc) works flawlessly, so think the ISP side of things are ok. Switches are ok.

 

execute clear system arp table

 

Did actually work a few times.

 

Any ideas gentlemen? A bit lost with this one...

 

(Will open a high prio case with TAC)

    1 reply

    ericli_FTNT
    Staff
    ericli_FTNT
    Staff
    March 9, 2018

    Hi Richie, failure of device without any log left is always not good.

     

    Did you double check the log setting? Do you deploy and central logging device like FortiAnalyzer? Your case is critical for us. Please keep updated. Thanks!

    kallbrandt
    kallbrandtAuthor
    New Member
    March 9, 2018

    Yes, FortiAnalyzer is deployed. Have logs some 120 days back. But nothing for the VIPs when they go offline. That's why we though this might be an ISP issue with ARP in the on-premise router. It for sure looks like no traffic is reaching the Fortigate.

    Outgoing NAT:ed traffic is showing up as timeouts. Very weird it seems to work when you change IP-Pool. And it is random - One IP-Pool that worked earlier might be dead the next time you try. Although high numbers in the public /24 we use seems to work better then the low ones. How about that?!

    kallbrandt
    kallbrandtAuthor
    New Member
    March 9, 2018

    Opened a case w. TAC. Customer is going to get a bunch of new Fortigates soonish (the 800c cluster is closing in on 5 years), but it would be grand if we could keep the old ones alive for some 4 months more...

     

    Terms & ConditionsAccessibility statement