Asymmetric routing issues after upgrade to 5.0.11

[Diabolicus23]

I've an environment with massive asymmetric routing usage.

Till 5.0.9 everything was working, today we've upgraded to 5.0.11 and a lot of problems started.

In the debug flow I see a lot of entries like this one:

2015-01-29 12:24:25 id=13 trace_id=153 func=print_pkt_detail line=4313 msg="vd-root received a packet(proto=6, 192.168.1.189:60745->192.168.21.24:80) from port3. flag [.], seq 3638772173, ack 582658221, win 64240" 2015-01-29 12:24:25 id=13 trace_id=153 func=resolve_ip_tuple_fast line=4372 msg="Find an existing session, id-004158ef, original direction" 2015-01-29 12:24:25 id=13 trace_id=153 func=tcp_anti_reply line=981 msg="org dir, ack in state syn_sent, drop"

Could you help me understaing the issue?

[emnoc]

Simple you have half-open tcp session due to asymmetrical routing. You need to double check asym routing rolled over in  the cfg from the upgrade and monitor a few policies

config system settings       set asymroute enable  ( ipv4 )       set asymroute6 enble ( ipv6 )

en

FWiW: 9 out of 10 times "org dir, ack in state syn_sent, drop" is half-tcp  openings and the  fortigate is dropping the packets.

Then you look at the full  session table & monitor.

e.g

diag sys session filter  policy   20 24

diag sys session filter  proto 6 diag sys session full-sta

[Diabolicus23]

Yep, enabling asymroute did the trick.

The thing I don't understand is that in the previous config (the one with the old firmware) we didn't have asymroute enable...

[Robin_Svanberg]

Diabolicus23 wrote:

Yep, enabling asymroute did the trick.

The thing I don't understand is that in the previous config (the one with the old firmware) we didn't have asymroute enable...

We did an upgrade from 5.2.2 to 5.2.3 and got the same issue.

Did you ever find out if Fortinet did some changes on this from 5.0.9 to 5.0.11? 

It seems like a bug that was fixed..

[michael_briceno77]

Not, you has disable antireplay..

config sys global

set anti-replay  disable

end

good look