200F, 7.2.8, EMAC VLANS, and Ansible HTTPAPI with intermittent failures

[aguerriero]

I have an issue on a 200F, running 7.2.8. I have two EMAC vlans. One where the ansible host is running (VLAN1818). And another that is shared across multiple firewalls and vdoms across the network (VLAN0998).

I have an ansible playbook with 20 tasks in it. When the ansible host is on vlan 1818, If I start the playbook it will randomly fail on any of the 20 tasks. If I try often enough it may make it through all 20 tasks.

If I move the ansible host to vlan 998 the playbook will complete 100 percent of the time across the 100 tests I have performed.

This does not appear to impact 200E, 201E, 101E, 60F, 1100E, or 1500Ds that also share this architecture. It is only the 200F that is experiencing this problem.

[Stephen_G]

Hello aguerriero,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Stephen_G]

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Regards,

[Stephen_G]

Hi aguerriero,

While we wait for a reply, I can give some analysis/recommendations from my limited knowledge.Sorry this is taking longer than usual.

It's unusual this is only occurring on 200F. Is the configuration definitely the same as it is on the other models tested?

I recommend the following:

• Check your VLAN configurations on the 200F to make sure they're set up correctly and there are no conflicting settings with the Ansible playbooks.
• Review firewall policies to make sure none of the traffic needed by the playbooks is getting blocked.
• Monitor resource usage to see if there's any bottlenecking causing unusual behavior.
• Make sure the 200F is on the latest firmware.
• Perform a packet capture if possible and compare the packets in the successful setup with the unsuccessful one.

Feel free to contact TAC support if these don't work out and you need the 200F setup running.

[aguerriero]

• Check your VLAN configurations on the 200F to make sure they're set up correctly and there are no conflicting settings with the Ansible playbooks.

The vlans are emac vlans all other systems in 1818 work just fine. If there was a vlan or tagging issue there would be more problems for other systems.

• Review firewall policies to make sure none of the traffic needed by the playbooks is getting blocked.

The firewall policy is isolated to test this. I have a permit all all all from the ansible system to the vlan 998 subnet. UTM, logging, inspections of any kind are disabled. Also this would not explain why sometimes all tasks complete and sometimes it stops at a random task that fails with an no response error from the API endpoint. Firewall policies should not be intermittently blocking allowed traffic.

• Monitor resource usage to see if there's any bottlenecking causing unusual behavior.

Resource utlization is fine.

• Make sure the 200F is on the latest firmware.

All firewalls are running 7.2.8 which is the latest firmware.

• Perform a packet capture if possible and compare the packets in the successful setup with the unsuccessful one.

Packet capture shows that the API sometimes just doesn't respond or send back any traffic after the initial TCP handshake.

[alif]

Hi @aguerriero,

Please disable offloading on firewall policy and see if the issue persists.

If possible, please upgrade to FortiOS 7.4 version as well as it could be something specific on 7.2.