Technical Tip: How to prevent duplication of Self-Generated traffic in Transparent Mode

[sdabhade]

Description	This article describes how to prevent duplication of self-generated traffic in Transparent mode.
Scope	FortiGate.
Solution	In Transparent Mode, for self-generated traffic, FortiGate uses ARP to learn the MAC address of a directly connected destination IP or the gateway IP for destinations reached via a static gateway. The following example illustrates the circumstance under which self-generated traffic duplication can occur for a Transparent Mode Syslog server at IP 192.168.1.1, reachable via gateway IP 10.10.10.2: FGT (VDOM1)# config system settings     set opmode transparent     set manageip 10.10.10.1/255.255.255.0 end FGT (VDOM1)# config log syslogd3 override-setting     set status enable     set server "192.168.1.1"     set format cef end FGT (VDOM1)# config router static     edit 1            set gateway 10.10.10.2        next end Initially, Transparent Mode will learn the MAC address for the gateway IP 10.10.10.2, which can be verified using the command below: FGT (VDOM1) # get system arp Address Age(min) Hardware Addr Interface 10.10.10.2 88694 aa:aa:aa:aa:aa:aa VDOM1.b FortiGate looks up the egress interface based on the destination MAC address aa:aa:aa:aa:aa:aa in the forwarding table and forwards the traffic through Vlan10: FGT (global) # diagnose netlink brctl name host VDOM1.b show bridge control interface VDOM1.b host. fdb: hash size=32768, used=2471, num=2794, depth=71, gc_time=4, ageing_time=3 Bridge VDOM1.b host table port no device devname mac addr ttl attributes 13 86 Vlan10 aa:aa:aa:aa:aa:aa 0 Hit(0) If multiple VLANs, including Vlan10, are connected to the same gateway port and share the same MAC address aa:aa:aa:aa:aa:aa, self-generated traffic will be sent with different VLAN tags in their respective forwarding domains. As per the below forwarding table, Vlan10 and Vlan20 have the same gateway's MAC aa:aa:aa:aa:aa:aa, and duplicate self-originated packets can be sent to the syslog server against both the VLANs. FGT (global) # diagnose netlink brctl name host VDOM1.b show bridge control interface VDOM1.b host. fdb: hash size=32768, used=2471, num=2794, depth=71, gc_time=4, ageing_time=3 Bridge VDOM1.b host table port no device devname mac addr ttl attributes 13 86 Vlan10 aa:aa:aa:aa:aa:aa 0 Hit(0) 14 87 Vlan20 aa:aa:aa:aa:aa:aa 0 Hit(0) ICMP duplicate replies may occur when pinging gateway IP 10.10.10.2, as FortiGate cannot determine the correct interface and sends the request from both VLANs, resulting in duplicate replies: FGT (VDOM1)# execute ping 10.10.10.2 PING 10.10.10.2 (10.10.10.2): 56 data bytes 64 bytes from 10.10.10.2: icmp_seq=0 ttl=64 time=1.2 ms 64 bytes from 10.10.10.2: icmp_seq=0 ttl=64 time=3.7 ms (DUP!) 64 bytes from 10.10.10.2: icmp_seq=1 ttl=64 time=0.9 ms 64 bytes from 10.10.10.2: icmp_seq=1 ttl=64 time=2.4 ms (DUP!) 64 bytes from 10.10.10.2: icmp_seq=2 ttl=64 time=2.1 ms 64 bytes from 10.10.10.2: icmp_seq=2 ttl=64 time=4.1 ms (DUP!) 64 bytes from 10.10.10.2: icmp_seq=3 ttl=64 time=4.2 ms 64 bytes from 10.10.10.2: icmp_seq=3 ttl=64 time=8.7 ms (DUP!) 64 bytes from 10.10.10.2: icmp_seq=4 ttl=64 time=3.0 ms This is expected behavior when the gateway device port shares the same MAC for multiple VLANs and can be resolved by configuring the gateway device to generate a unique MAC for each VLAN, such as using emac-vlan.