Adaptive Forward Error Correction

[HT_JDC]

Hello Experts,

Confirmation for "Adaptive Forward Error Correction (FEC)".

https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/169010/adaptive-forward-erro...

Is Adaptive FEC only applied to the existing "virtual-wan-link" SD-WAN zone?

I tried it for my created/custom zone which belongs to IPsec tunnel members,

however, it does not seem to work.

FEC counter is not increased at "diag vpn tunnel fec VPN-NAME".

If any, I would like to know the official KB ID and/or the reference.

Any comments are appreciated.

Best regards,

[Jean-Philippe_P]

Hello HT_JDC, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

[Jean-Philippe_P]

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

[Jean-Philippe_P]

Hello again HT_JDC,

I found this solution. Can you tell us if it helps, please?

Adaptive Forward Error Correction (FEC) is designed to work within the SD-WAN framework, specifically with the "virtual-wan-link" SD-WAN zone. If you are attempting to apply Adaptive FEC to a custom zone that includes IPsec tunnel members and it is not functioning as expected, it may be due to the configuration not aligning with the supported SD-WAN setup.

To troubleshoot this issue, ensure that:

1. The IPsec tunnel is part of the "virtual-wan-link" SD-WAN zone.
2. The FEC profile is correctly configured and applied to the appropriate traffic streams.
3. The SD-WAN health checks and SLA metrics are properly set up to trigger FEC adjustments.
   
   

Unfortunately, I do not have a specific KB ID or reference for this issue. If the problem persists, consider reaching out to Fortinet support for further assistance.

[HT_JDC]

Dear Jean-Philippe,

Thanks for you answer.

I checked both egress and ingress in IPsec configuration.

However, it seems that FEC counter is not increased, seeing result of "diag vpn tunnel fec VPN-NAME". 

Performance SLA is configured and  "Best quality" strategy is selected with the SLA.

You said:

• The FEC profile is correctly configured and applied to the appropriate traffic streams.
• The SD-WAN health checks and SLA metrics are properly set up to trigger FEC adjustments.

Can you tell me exactly what needs to be configured to activate Adaptive FEC?

Any comments are appreciated.

Best regards,

[Jean-Philippe_P]

Hello again HT_JDC,

I found this answer for you: 

To activate Adaptive Forward Error Correction (FEC) in your IPsec configuration, ensure the following steps are completed:

1. SD-WAN Zone Configuration: Ensure the IPsec tunnel is part of the "virtual-wan-link" SD-WAN zone.
   
   

2. FEC Profile Configuration:

   • Configure the FEC profile with appropriate base and redundant packet settings.
   • Example:
     
     

   • config vpn ipsec phase1-interface
     edit <Tunnel-Intf>
     set fec-egress enable
     set fec-ingress enable
     set fec-health-check "Performance_SLA"
     set fec-mapping-profile "FEC-Profile"
     set fec-redundant 1
     set fec-base 10
     next
     end

3. Performance SLA Configuration:

   • Ensure a Performance SLA is configured and associated with the SD-WAN zone.
   • The SLA should monitor metrics like packet loss, latency, and jitter.
     
     

4. SD-WAN Strategy: Select the "Best Quality" strategy to ensure traffic is routed based on the best available link quality.

5. Traffic Policy: Ensure that the traffic sensitive to packet loss is identified and a dedicated firewall policy is in place where FEC is enabled.
   
   

6. Verification: Use the command diagnose vpn tunnel fec <Tunnel_Intf> to verify FEC status and counters.
   
   

If all configurations are correct and the FEC counters are still not increasing, verify that the network conditions meet the thresholds set for FEC activation, such as packet loss exceeding the configured threshold. If issues persist, further investigation may be needed to ensure all configurations are correctly applied.

[HT_JDC]

Dear Jean-Philippe,

Thanks for your reply.

set fec-mapping-profile "FEC-Profile"

What is "FEC-Profile"?

It is new to me. Should I configure somewhere?

Can you tell me where/what/how to do?

Thanks in advance and best regards,

[Jean-Philippe_P]

The "fec-profile" in the context of IPsec VPN configuration refers to a Forward Error Correction (FEC) mapping profile. This profile defines how FEC is applied based on network conditions such as packet loss, latency, and bandwidth thresholds.

To configure an FEC profile, follow these steps:

1. Define FEC Mappings:

   • Access the CLI of your FortiGate device.
   • Use the command config vpn ipsec fec to enter the FEC configuration mode.
   • Create a new FEC profile using edit <name>, where <name> is your desired profile name.
   • Under config mappings, define the parameters such as base, redundant, packet-loss-threshold, etc.
     
     

2. Set Parameters:

   • base: Number of base FEC packets.
   • redundant: Number of redundant FEC packets.
   • packet-loss-threshold: Packet loss percentage to trigger FEC.
   • Other thresholds like latency and bandwidth can also be set as needed.
     
     

3. Apply the FEC Profile: Attach the FEC profile to the IPsec tunnel interface using the command set fec-mapping-profile "<fec-profile>" in the config vpn ipsec phase1-interface section.
   
   

4. Verify Configuration: Use the command diagnose vpn tunnel fec <Tunnel_Intf> to check the FEC status and ensure it is applied correctly.
   
   

Ensure that the FEC profile is tailored to your network conditions and requirements. If you need further assistance, refer to the Fortinet documentation or contact support.

[HT_JDC]

Dear Jean-Philippe,

Thanks for your detailed explanation.

The same parameters such as 'base/fec-base' and 'redundant/fec-redundant' are configured in both "config vpn ipsec fec" and "config vpn ipsec phase1-interface".

Do we really need to configure them in both section?

What are the differences in the 2 sections?

Thanks in advance and best regards,