FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
This article concerns PPTP traffic being unable to establish when passed through the SLBC solution.
PPTP traffic is using PPTP protocol and GRE tunneling. Traffic for this PPTP protocol and GRE tunneling was load balanced by two different blades that caused the PPTP traffic to be unable to connect to the PPTP server.
FortiController SLBC, v5.2.4
Apply the following configuration to the FortiController to make sure that all PPTP traffic is being processed by the Master blade only.
Ensure also that gre-session is not load balanced by the FortiController as well by using the following command.
#config load-balance session-setup (session-setup)# get fragment : disable gre-session : disable -> this is disabled so gre traffic will not be load balanced and will be processed by config master only gtp-session : disable ipsec-session : forward-to-master load-distribution-method: src-dst-ip-sport-dport sctp-session : disable session-helper : enable tcp-ingress : disable udp-ingress : disable udp-session : remote