I'm testing FGSP and VRRP using foritgate VMs. The topology is as follows:
FirewallA (VRRP Master)--------L2VPN--------FirewallB (VRRP Backup)
There are 3 servers:
Server A connects to Firewall A
Server B connects to Firewal B
Server C is in the VRRP domain and will reside in either Firewall
The issue I've observed is When Server C tries to connect to Server B, it fails and the debug flow shows a reverse check failure. I am not sure why this is happening with FGSP enabled, as all other traffic syncs across fine. However, Server B is able to connect to Server C.
When I make Firewall B the VRRP master server C can connect to Server B, but then loses access to Server A. It seems like FGSP isn't synic traffic that's directly conncted to the Fortigates that is acting as VRRP backup. All other transit traffic thats asymmetric FGSP handles it fine.
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi Atul,
Using policy route to direct traffic for Server B fixes the issue. Using Policy route isn't ideal as I'd like the foritgate to use the BGP routes for resiliency. is this particual issues resolved on newer firmware versions?
Hi,
Since FGSP exclude UDP and ICMP (connectionless) session synchronization including expectation session, please use the below guides to help optimise FGSP:
Check if configuring the policy route help in this situation. I agree with your suspicion that the directly connected host being local and its associated sessions are not synced across in this situation.
Thanks,
Created on 10-11-2024 04:35 PM Edited on 10-11-2024 04:36 PM
Hello,
Yes I have this enabled as well. See config below.
FortiGate-VM64-KVM # show system ha
config system ha
set session-pickup enable
set session-pickup-connectionless enable
set session-pickup-expectation enable
set override disable
end
I will try policy route and see if that works. As a test I enabled asym route and the servers started responding. So bit strange FGSP isn't doing that.
Hi Atul,
Using policy route to direct traffic for Server B fixes the issue. Using Policy route isn't ideal as I'd like the foritgate to use the BGP routes for resiliency. is this particual issues resolved on newer firmware versions?
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1692 | |
1087 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.