Adaptive Forward Error Correction

[HT_JDC]

Hello Experts,

Confirmation for "Adaptive Forward Error Correction (FEC)".

https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/169010/adaptive-forward-erro...

Is Adaptive FEC only applied to the existing "virtual-wan-link" SD-WAN zone?

I tried it for my created/custom zone which belongs to IPsec tunnel members,

however, it does not seem to work.

FEC counter is not increased at "diag vpn tunnel fec VPN-NAME".

If any, I would like to know the official KB ID and/or the reference.

Any comments are appreciated.

Best regards,

[HT_JDC]

Dear Jean-Philippe,
Thanks. Unfortunately, FEC counter ("diag vpn tunnel fec VPN-NAME") is not still increased. Here are some of configurations. (Excuse me for the long one.)

config vpn ipsec fec
edit "fec1"
config mappings
edit 1
set base 10
set redundant 5
set packet-loss-threshold 1
set latency-threshold 1
next
end
next
end

config vpn ipsec phase1-interface
edit "vpn1_1"
set interface "wan1"
set peertype any
set net-device disable
set aggregate-member enable
set proposal des-md5
set npu-offload disable
set nattraversal forced
set fec-egress enable
set fec-base 20
set fec-codec rs
set fec-ingress enable
set fec-health-check "remotePing"
set fec-mapping-profile "fec1"
set remote-gw 192.168.4.2
set psksecret ENC yyyyy
set dpd-retryinterval 1
next
end

SDWAN2-1 (remotePing) # show
config health-check
edit "remotePing"
set server "2.2.2.2"
set interval 1000
set probe-timeout 1000
set failtime 3
set recoverytime 3
set members 0
config sla
edit 1
next
end
next
end

SDWAN2-1 (4) # show
config service
edit 4
set name "UseOfVirtualWanLink"
set mode priority
set dst "all"
set src "all"
set health-check "remotePing"
set priority-members 1 2
set priority-zone "virtual-wan-link"
next
end

I also asked ChatGPT. It said "set npu-offload disable" and "set nattraversal forced" are necessary.

The simulator by Linux "tc" command which causes packet loss and latency is inserted into WAN lines. "iperf" is executed to get traffic.

What are missing? Any comments are appreciated.

Best regards,

[HT_JDC]

Dear Jean-Philippe and Experts,

I found FEC counter is incremented, by adding "set fec enable at firewall policy.

Only configurable at CLI.

I tried the following both cases. FEC counter is incremented at case 1, however, it is NOT incremented at case 2.

Case 1
Network A (eg. 192.168.10.0/24) -- Fortigate1 ----- Fortigate2 -- Network B (eg. 192.168.20.0/24)

Case 2 (Realization of the same network by VXLAN)
Network C (eg. 10.1.1.0/24) -- Fortigate1 ----- Fortigate2 -- Network C (eg. 10.1.1.0/24)

I guess FEC is not applied for LAN L2 I/F. Is it correct?

Any comments would be helpful.

Best regards,

[Jean-Philippe_P]

Yes, your observation is correct. Forward Error Correction (FEC) is typically applied to Layer 3 traffic, such as IPsec VPN tunnels, where it can help mitigate packet loss by sending redundant packets. In Case 1, where the traffic is routed between different networks (Layer 3), FEC can be applied and the counter increments as expected.

In Case 2, where VXLAN is used to extend Layer 2 networks across FortiGates, FEC is not applicable because VXLAN operates at Layer 2. FEC is not designed to handle Layer 2 traffic, which is why you do not see the FEC counter incrementing in this scenario.