FortiGate drops traceroute UDP

[arie_arie]

Hi,

Based on this KB: https://community.fortinet.com/t5/FortiGate/Technical-Note-ICMP-and-UDP-traceroute-functionality-wit....

I know that the UDP based traceroute will be dropped by FortiGate if I try to traceroute to FortiGate' IP address (e.g. management IP).

But for endpoint behind the FortiGate, does FortiGate also drop this UDP based traceroute even I have allowed any in the firewall policy?

Thank you

[srajeswaran]

Fortigate is expected to take action based on the firewall policy, if you have allowed it ideally it is expected to work fine.

[arie_arie]

Hi,

I see, I think I need to do debug flow to see why the traceroute packet is not sent to endpoint.

[srajeswaran]

Yes, flow debug will give us better idea. Can you make sure the endpoint IP is not configured on Fortigate as any VIP?

[arie_arie]

Yes, the endpoint is not configured as any VIP.

The endpoint gateway is on the FortiGate