Troubleshooting Tip: Egress shaping issue on EMAC Interface

[yzayani]

Description	This article describes an issue where traffic is not allowed on EMAC interfaces after upgrading from 7.6.x. The issue is caused by egress-shaping applied on the EMAC-VLAN interface, which leads to traffic drops when QTM and EMAC-VLAN interfaces use IVS.
Scope	FortiOS.
Solution	Network Setup: VDOM1/2 connected directly over LAG, with EMAC interfaces used. Issue: After upgrading, EMAC interfaces cannot ping each other, resulting in ICMP destination unreachable errors: FortiGate (vdom1) # exec ping 33.33.33.2 PING 33.33.33.2 (33.33.33.2): 56 data bytes Warning: Got ICMP 3 (Destination Unreachable) ^C --- 33.33.33.2 ping statistics --- 5 packets transmitted, 0 packets received, 100% packet loss HTX Drop: Traffic drops are seen in the htx drop counters when the issue occurs: [NP7_0] Module SSE_TPE EGR_FLOW IGR_FLOW TPE MAC_FILTER ETH_ACT TGT_ACT SRC_ACT Total --------------- ---------- ---------- ---------- ---------- ---------- ---------- ---------- htx 0 0 0 0 0 0 5 0 5 --------------- ---------- ---------- ---------- ---------- ---------- ---------- ---------- Total_drop : 5 Egress-Shaping Issue: Traffic is blocked when egress-shaping is applied on the EMAC-VLAN interface. Removing and reapplying the shaping profile temporarily resolves the issue, but it reoccurs after a reboot. IVS Conflict: Both QTM (Quantum Management) and EMAC-VLAN interfaces use IVS (Interface Virtual Switch). Applying egress-shaping on the EMAC-VLAN interface creates a conflict between QTM's IVS and EMAC-VLAN's IVS, leading to blocked traffic. NP7 Limitation: NP7 currently supports only physical, VLAN, LAG, and IPsec tunnel interfaces. The EMAC-VLAN interface with egress-shaping applied is unsupported, causing the issue. Resolving the issue: Unset the egress-shaping profile and then set it back.