Load test packet loss

[theoleek]

I am try to load test FortiGate VM using cisco Trex. While this works perfectly on the current pfsense setup, I cannot get it to work on FortiGate.

Simple routing and firewall rules have been set up the same as pfsense and  can see that the one firewall rule is beng used based on the bandwidth usage. When looking at foward traffic logs it seems that some traffic is getting through fine but the majority of traffic does not seem to be accepted as is mostly droppped.

I have tried the following so far;

• Using Policy routes rather than static routes produces the same result
• Change the interface types from unspesified to WAN or LAN
• Added DoS policy, no change
• Changed NAT settings in firewall rules
• Changed protocol options in firewall rules

Looking at forward traffic it seems that traffic that is having issues is the following

Duration	5
Session ID	63,877
VDOM	root
NAT Translation	noop

Source

Source	16.0.0.14
Source Port	5,796
Source Country/Region	United States
Primary Source Mac	00:0c:29:93:42:f3
Source Interface

port1

Destination

Destination	48.0.7.7
Destination Port	80
Destination Country/Region	United States
Destination Interface

port2

Application Control

Application Name	HTTP
Category	unscanned
Protocol	6
Service	HTTP

Data

Received Bytes	33.02 kB
Received Packets	23
Sent Bytes	813 B
Sent Packets	14

Action

Action	client-rst
Security Action
Policy ID	0to1
Policy UUID	57417294-aca1-51ed-d32e-e59d083a0abd
Policy Type	Firewall

Security

Level

notice

Cellular

Service

HTTP

Other

Log event original timestamp	1676410894150044700
Timezone	+0000
Log ID	0000000013
Type	traffic
Sub Type	forward
Source Interface Role	wan
Destination Interface Role	lan
Policy Name	0to1
Source Server	0

[CyberaNOC]

We were running into the same issue when using Cisco Trex to test a FortiGate VM.

FortiNet support helped us find that the ARP entries were disappearing from the FortiGate VM.

Even though we are not sure why that was happening, a workaround is to add static ARP entries for the Cisco Trex IPs in the FortGate VM, for example (adjust for the correct IPs and MAC addresses):

config system arp-table
edit 1
set interface port2
set ip 192.168.2.2
set mac 0d:56:20:fc:2d:46
next
edit 2
set interface port3
set ip 192.168.3.3
set mac cf:ea:78:0b:89:12
end