Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
massive627
New Contributor II

FGSP and VRRP routing issue

I'm testing FGSP and VRRP using foritgate VMs.  The topology is as follows:

 

 

FirewallA (VRRP Master)--------L2VPN--------FirewallB (VRRP Backup)

 

There are 3 servers:

Server A connects to Firewall A

Server B connects to Firewal B

Server C is in the VRRP domain and will reside in either Firewall

 

The issue I've observed is When Server C tries to connect to Server B, it fails and the debug flow shows a reverse check failure.  I am not sure why this is happening with FGSP enabled, as all other traffic syncs across fine.  However, Server B is able to connect to Server C.

 

When I make Firewall B the VRRP master server C can connect to Server B, but then loses access to Server A.  It seems like FGSP isn't synic traffic that's directly conncted to the Fortigates that is acting as VRRP backup.  All other transit traffic thats asymmetric FGSP handles it fine.

 

1 Solution
massive627
New Contributor II

Hi Atul,

 

Using policy route to direct traffic for Server B fixes the issue.  Using Policy route isn't ideal as I'd like the foritgate to use the BGP routes for resiliency.  is this particual issues resolved on newer firmware versions?

View solution in original post

3 REPLIES 3
Atul_S
Staff
Staff

Hi,

 

Since FGSP exclude UDP and ICMP (connectionless) session synchronization including expectation session, please use the below guides to help optimise FGSP:

 

https://docs.fortinet.com/document/fortigate/6.4.0/ports-and-protocols/796662/fgsp-fortigate-session...

 

https://docs.fortinet.com/document/fortigate/7.0.0/new-features/018108/optimizing-fgsp-session-synch...

 

Check if configuring the policy route help in this situation. I agree with your suspicion that the directly connected host being local and its associated sessions are not synced across in this situation.

 

Thanks,

Atul Srivastava
massive627
New Contributor II

Hello,

 

Yes I have this enabled as well.  See config below.

 

FortiGate-VM64-KVM # show system ha
config system ha
set session-pickup enable
set session-pickup-connectionless enable
set session-pickup-expectation enable
set override disable
end

 

I will try policy route and see if that works.  As a test I enabled asym route and the servers started responding.  So bit strange FGSP isn't doing that. 

massive627
New Contributor II

Hi Atul,

 

Using policy route to direct traffic for Server B fixes the issue.  Using Policy route isn't ideal as I'd like the foritgate to use the BGP routes for resiliency.  is this particual issues resolved on newer firmware versions?

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors