Technical Tip: FortiGate replies to pings on down interface

jangelis · ‎05-21-2022

Description

This article describes that FortiGate replies to ping requests to an IP configured on a currently down interface.

Scope

FortiGate.

Solution

There are two cases:

1) Link is down, but the port is administratively up (e.g. disconnected cable).

FortiGate will reply to a ping request

There is an up flag:

fortigate # diag netlink interface list

if=port3 family=00 type=1 index=9 mtu=1500 link=0 master=0
ref=14 state=start present no_carrier fw_flags=0 flags=up broadcast multicast

2) Port is administratively down (set status down).

In this case, FortiGate will not reply.

There is no up flag:

fortigate # diag netlink interface list

if=port3 family=00 type=1 index=9 mtu=1500 link=0 master=0
ref=9 state=present no_carrier fw_flags=0 flags=broadcast multicast