Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
UTM4thewin
New Contributor

Fortigate dropping SCTP Heartbeat Requests

Having issues with a Fortigate policy for a sigtran M3UA association.  After troubleshooting I confirmed that the policy and route are correct in the firewall; however, it does not appear that the firewall allows SCTP Heartbeat Requests to traverse the path without first seeing the SCTP handshake containing the INIT & INIT-ACK.  While this makes sense for flow-base inspection of traffic for a connection oriented flow it is not expected for a multi-homed M3UA connection based on RFC4960 section 5.4.  The client IP address that initiates the handshake works fine however the additional multi-home IP addresses fail because the Fortigate drops the Heartbeat requests that are used to verify the path for the other IP addresses in the M3UA association.  

 

HW: Fortigate 300D

OS: FortiOS 5.4

0 REPLIES 0
Labels
Top Kudoed Authors