Having issues with a Fortigate policy for a sigtran M3UA association. After troubleshooting I confirmed that the policy and route are correct in the firewall; however, it does not appear that the firewall allows SCTP Heartbeat Requests to traverse the path without first seeing the SCTP handshake containing the INIT & INIT-ACK. While this makes sense for flow-base inspection of traffic for a connection oriented flow it is not expected for a multi-homed M3UA connection based on RFC4960 section 5.4. The client IP address that initiates the handshake works fine however the additional multi-home IP addresses fail because the Fortigate drops the Heartbeat requests that are used to verify the path for the other IP addresses in the M3UA association.
HW: Fortigate 300D
OS: FortiOS 5.4
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1709 | |
1093 | |
752 | |
446 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.