Loopback VIP issue on reverse path check fail, drop

[LVHan]

I did follow the tech doc as below

https://community.fortinet.com/t5/FortiGate/Technical-Note-How-to-configure-a-VIP-using-a-loopback-i...

but when debug flow, i receive reverse path check fail, drop error when after the DNAT success

FortiGate
1. Loopback IP 192.168.1.254
2. Port 1 (WAN)  - 192.168.1.1/28
3. Port 2 (LAN) - 192.168.1.128/28
4. Site to Site VPN (S2S-DC)
Route static
10.1.1.0/24 via port 2
172.16.30.0/24 via S2S-DC

my connection is come from site to site vpn  DC  172.16.30.1 --> loopback 192.168.1.254 (DNAT - 10.1.1.1)  --> Port 2 --> 10.1.1.1

routing shouldnt be problem but debug flow still receive error reverse path check fail, drop, looking for 192.168.1.254 although is connected.

I perform PCAP on S2S-DC , packet did reach to FW.
PCAP  on port 2 no source ip 172.16.30.1 found. the packet been drop in fw and not related to return route

update : i restart router engine still having such issue

[sjoshi]

Hi,

Can you share:-

get router info routing-table details 172.16.30.1 

[LVHan]

Without static route
get router info routing-table details 172.16.30.1

Routing table for VRF=0
Routing entry for 0.0.0.0/0
Known via "static", distance 25, metric 0, best
* vrf 0 192.168.1.2, via port1

With static route configure

get router info routing-table details 172.16.30.1

Routing table for VRF=0
Routing entry for 172.16.30.0/24
Known via "static", distance 10, metric 0, best
via S2S-DC tunnel 58.26.10.2 vrf 0, tun_id


Tunnel is enable automatic route add, but it seem not working. Other tunnel automatic route add

match policy no issue, herewith the debug flow, it stopped looking for route
id=65308 trace_id=42 func=__ip_session_run_tuple line=3455 msg="DNAT 192.168.1.254:8->10.1.1.1:1"
id=65308 trace_id=42 func=ip_route_input_slow line=1695 msg="reverse path check fail, drop"

get router info routing-table details 192.168.1.254

Routing table for VRF=0
Routing entry for 192.168.1.254/32
Known via "connected", distance 0, metric 0, best
* is directly connected, 192.168.1.254

[sjoshi]

is it working when you add the static route:-

With static route configure

get router info routing-table details 172.16.30.1

Routing table for VRF=0
Routing entry for 172.16.30.0/24
Known via "static", distance 10, metric 0, best
via S2S-DC tunnel 58.26.10.2 vrf 0, tun_id

[LVHan]

Nope

[dingjerry_FTNT]

Hi @LVHan ,

For the traffic from S2S-DC to VIP, please enable NAT. 

Please also share the outputs of debug flow commands.

[LVHan]

config firewall policy
edit 218
set name "Test-321"
set srcintf "loopback"
set dstintf "port2"
set action accept
set srcaddr "all"
set dstaddr "VIP-10.1.1.1"
set schedule "always"
set service "ALL"
set logtraffic all
set nat enable
next
end

still same debug error

DNAT 192.168.1.254:8->10.1.1.1:1
reverse path check fail, drop
trace

[dingjerry_FTNT]

Hi @LVHan ,

No, this policy is for traffic from VIP to LAN. I was talking about traffic from S2S-DC to "loopback." You must have a firewall policy to allow this traffic.  You need to enable the NAT on that firewall policy.

Anyway, please share the debug flow outputs.

[dingjerry_FTNT]

I bet the very first line of "trace_id=42" is "from loopback" for source IP "172.16.30.1".

If so, please enable NAT in another firewall policy from S2S-DC to "loopback".

If not, please share full debug flow outputs for "trace_id=42".

[LVHan]

config firewall policy
edit 202
set name "Test-123"
set srcintf "S2S-DC"
set dstintf "192.168.1.254"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
set logtraffic all
set nat enable
next
end

id=65308 trace_id=283 func=print_pkt_detail line=5862 msg="vd-root:0 received a packet(proto=1, 192.168.1.128:1->192.168.1.254:2048) tun_id=58.26.3.2 from S2S-DC. type=8, code=0, id=1, seq=5978."
id=65308 trace_id=283 func=init_ip_session_common line=6047 msg="allocate a new session-003a75ef"
id=65308 trace_id=283 func=iprope_dnat_check line=5281 msg="in-[S2S-DC], out-[]"
id=65308 trace_id=283 func=iprope_dnat_tree_check line=824 msg="len=1"
id=65308 trace_id=283 func=__iprope_check_one_dnat_policy line=5146 msg="checking gnum-100000 policy-18"
id=65308 trace_id=283 func=get_new_addr line=1213 msg="find DNAT: IP-10.1.1.1, port-0(fixed port)"
id=65308 trace_id=283 func=__iprope_check_one_dnat_policy line=5236 msg="matched policy-18, act=accept, vip=18, flag=104, sflag=2000008"
id=65308 trace_id=283 func=iprope_dnat_check line=5293 msg="result: skb_flags-02000008, vid-18, ret-matched, act-accept, flag-00000104"
id=65308 trace_id=283 func=iprope_fwd_check line=768 msg="in-[S2S-DC], out-[192.168.1.254], skb_flags-02000008, vid-18, app_id: 0, url_cat_id: 0"
id=65308 trace_id=283 func=__iprope_tree_check line=524 msg="gnum-100004, use int hash, slot=71, len=12"
id=65308 trace_id=283 func=__iprope_check_one_policy line=2033 msg="checked gnum-100004 policy-4294967295, ret-no-match, act-accept"
id=65308 trace_id=283 func=__iprope_check_one_policy line=2033 msg="checked gnum-100004 policy-202, ret-matched, act-accept"
id=65308 trace_id=283 func=__iprope_user_identity_check line=1807 msg="ret-matched"
id=65308 trace_id=283 func=__iprope_check line=2281 msg="gnum-4e20, check-0000000070604c6e"
id=65308 trace_id=283 func=__iprope_check_one_policy line=2033 msg="checked gnum-4e20 policy-6, ret-no-match, act-accept"
id=65308 trace_id=283 func=__iprope_check_one_policy line=2033 msg="checked gnum-4e20 policy-6, ret-no-match, act-accept"
id=65308 trace_id=283 func=__iprope_check_one_policy line=2033 msg="checked gnum-4e20 policy-6, ret-no-match, act-accept"
id=65308 trace_id=283 func=__iprope_check line=2298 msg="gnum-4e20 check result: ret-no-match, act-accept, flag-00000000, flag2-00000000"
id=65308 trace_id=283 func=get_new_addr line=1213 msg="find SNAT: IP-192.168.1.254(from IPPOOL), port-60418"
id=65308 trace_id=283 func=__iprope_check_one_policy line=2251 msg="policy-202 is matched, act-accept"
id=65308 trace_id=283 func=iprope_fwd_check line=805 msg="after iprope_captive_check(): is_captive-0, ret-matched, act-accept, idx-202"
id=65308 trace_id=283 func=iprope_fwd_auth_check line=824 msg="after iprope_captive_check(): is_captive-0, ret-matched, act-accept, idx-202"
id=65308 trace_id=283 func=fw_pre_route_handler line=184 msg="VIP-10.1.1.1:1, outdev-unknown"
id=65308 trace_id=283 func=__ip_session_run_tuple line=3455 msg="DNAT 192.168.1.254:8->10.1.1.1:1"
id=65308 trace_id=283 func=ip_route_input_slow line=1695 msg="reverse path check fail, drop"
id=65308 trace_id=283 func=ip_session_handle_no_dst line=6133 msg="trace"