Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
squid-c
New Contributor II

Fortigate is not sending icmp redirects.

Fortigate is not sending icmp redirects.
"icmp-send-redirect" is setting enable.
I would like to be able to send ICMP redirects using the case 2 pattern.
If the PC is in the same segment as the FW,ICMP redirect responses are possible.
However, if there is a router between the PC and the FW and they are on different segments,
ICMP redirect responses will not be received.

 

Q
Aren't ICMP redirects sent to another segment?How does it work?


Case 1
In this case, the FW sent an ICMP redirect.

PC①------[FW①]------PC②
   |
   ----[FW②]------PC③

setting
PC①:192.168.1.1/24
PC②:192.168.2.1/24
PC③:192.168.3.1/24

routing
PC①: Default gateway is FW①
FW①: Setting static route "Gateway of destination PC③ is FW②"

 

Case 2
PC①----[RT①]------[FW①]------PC②
        |
        ----[FW②]------PC③
setting
PC①:192.168.1.1/24
PC②:192.168.2.1/24
PC③:192.168.3.1/24
RT①:Do not use NAT

routing
PC①: Default gateway is RT①
FW①: Setting static route "Gateway of destination PC③ is FW②"
FW②: Setting static route "Gateway of destination PC① is RT①"

 

Thanks

1 Solution
Dhruvin_patel

Greetings,

 

You would like to use ICMP redirect to inform the host about the better next hop to reach a certain destination.

 

First of all, enable the following settings on the interface, 

 

# config system interface

   edit "interface_name"

      set icmp-accept-redirect enable

      set icmp-send-redirect enable

   next

 

Afterward, make sure that the ICMP redirect is allowed on the Layer-3 router.

 

Still it fails, capture the packet on a port using this document and verify that the FortiGate is responding, https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Packet-Capture-on-FortiOS-GUI/ta-p/1... 

 

Regards,

If you have found a solution, please like and accept it to make it easily accessible to others.

Dhruvin Patel

View solution in original post

1 REPLY 1
Dhruvin_patel

Greetings,

 

You would like to use ICMP redirect to inform the host about the better next hop to reach a certain destination.

 

First of all, enable the following settings on the interface, 

 

# config system interface

   edit "interface_name"

      set icmp-accept-redirect enable

      set icmp-send-redirect enable

   next

 

Afterward, make sure that the ICMP redirect is allowed on the Layer-3 router.

 

Still it fails, capture the packet on a port using this document and verify that the FortiGate is responding, https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Packet-Capture-on-FortiOS-GUI/ta-p/1... 

 

Regards,

If you have found a solution, please like and accept it to make it easily accessible to others.

Dhruvin Patel
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors