Fortigate is not sending icmp redirects.

[squid-c]

Fortigate is not sending icmp redirects.
"icmp-send-redirect" is setting enable.
I would like to be able to send ICMP redirects using the case 2 pattern.
If the PC is in the same segment as the FW,ICMP redirect responses are possible.
However, if there is a router between the PC and the FW and they are on different segments,
ICMP redirect responses will not be received.

Q
Aren't ICMP redirects sent to another segment?How does it work?

Case 1
In this case, the FW sent an ICMP redirect.

PC①------[FW①]------PC②
　　　|
　　　----[FW②]------PC③

setting
PC①：192.168.1.1/24
PC②：192.168.2.1/24
PC③：192.168.3.1/24

routing
PC①: Default gateway is FW①
FW①: Setting static route "Gateway of destination PC③ is FW②"

Case 2
PC①----[RT①]------[FW①]------PC②
　　　　　　　　|
　　　　　　　　----[FW②]------PC③
setting
PC①：192.168.1.1/24
PC②：192.168.2.1/24
PC③：192.168.3.1/24
RT①：Do not use NAT

routing
PC①: Default gateway is RT①
FW①: Setting static route "Gateway of destination PC③ is FW②"
FW②: Setting static route "Gateway of destination PC① is RT①"

Thanks

[Dhruvin_patel · Accepted solution]

Greetings,

You would like to use ICMP redirect to inform the host about the better next hop to reach a certain destination.

First of all, enable the following settings on the interface, 

# config system interface

   edit "interface_name"

      set icmp-accept-redirect enable

      set icmp-send-redirect enable

   next

Afterward, make sure that the ICMP redirect is allowed on the Layer-3 router.

Still it fails, capture the packet on a port using this document and verify that the FortiGate is responding, https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Packet-Capture-on-FortiOS-GUI/ta-p/1... 

Regards,

If you have found a solution, please like and accept it to make it easily accessible to others.