No reliable connection with hardware lan switch and bridged ssid

[sanderl]

Ok hold on, this is going to be hard to believe and to describe. I have troubleshooted a lot and cannot find out where the problem lies. Suddenly I had this vague problems, of sites not loading, DNS not resolving, etc. Maybe related to upgrading to 7.0.10 or 7.0.11. Maybe not.

What does not work (but had always worked like this - for years):

• I have a (existing) hardware switch "lan" with an SSID bridged to that (no VLANs).
• The IP address is on the lan switch and the SSID is bridged.
• Created a new test policy, top placed any/any allow, no filtering, NAT to internet.
• When I connect a mobile to this SSID and start roblox (don't ask - this is a prio 1 for days now) it does not load any game.

What does work:

• I have created a (new) test vlan (99) with an IP address on it, and a test SSID bridged to that vlan (99), connected to the lan switch as my FortiAPs reside there.
• Created a new test policy, under the top placed any/any allow, no filtering, NAT to internet.
• When I connect a mobile to this SSID and start roblox it does load games.

EDIT: Roblox is "the" way of proving/testing above. As described a lot more is not working smoothly, but a refresh of the page will do. Roblox seems to be a lot more  "picky" in the coneection stability.

Both "networks" are giving out the same DNS servers.

I have 6 VLANS connected via the lan hardware switch which all work(ed) well for years. Of which 3 have an IP adress on the VLAN interface and 3 are connected in a software switch with a port.

--> this can also be a separate topic because since this week I discovered the Fortigate does not allow me to select a VLAN anymore as a member of a softwareswitch (!), but this used to work and still works. Nothing to find in any release notes...

I cannot find any mentioning of any change in behavior. Also I have no active subscription on this device (81E) and thus cannot call support.

Is there anything I can do to (more) narrow down this issue?

[sanderl]

Some extra information added. 2 files of traces. 

Trace Logging (failing):

dpaste/a8SOU (Python)

phone (192.168.1.175) connected to lan hardware switch failing to start roblox (DNS servers are on same subnet as phone).

Trace Logging (succesfull):

dpaste/kcoba (Python)

phone (192.168.99.2) connected to vlan99 succeeding to start robox. (DNS servers on lan, thus extra DNS traffic appended).

I really hope on any help :-).

[gfleming]

Can you try disabling NPU offloading for the non-working policy/policies?

https://docs.fortinet.com/document/fortigate/7.2.4/cli-reference/328620/config-firewall-policy

set auto-asic-offload disable

[sanderl]

Hi Graham, thank you for taking the time to look into my issue. I will look into your suggestion.

I do have a question about that. Why do you think it is the "policy"? Because I have created a new "simple" policy which has the same behavior as the existing policy.

to be clear:

on the lan hardwareswitch an any any allow to internet is enabled which does not alllow roblox to work.

on the vlan the same policy is in which does allow roblox to work.

EDIT: Tried you suggestion on the "faulty" policy 42. No change in behavior.

I do run 7.0.11, the documentation does to 7.2.4 and when selecting 7.0.11 it changes to local in policy...?

[sanderl]

Additional information.

I created a new (empty) hardwareswitch (hsw10) with port 10.

Connected a fortiap to port 10.

bridged an ssid to it.

added a new subnet on hsw10.

Added policy to internet.

Roblox works...

I have checked all settings of the network, compared all cli config.

There is really nothing to be seen that might play in here.

Any more help greatly appreciated. 

[sanderl]

Sorry to chime in again. i could really use some help as most of my users are on lan (hardwareswitch) and all experience this unreliable traffic... wired / wireless (bridged). Please advise.

[gfleming]

If this is urgent I would suggest getting in touch with TAC.

Can you provide a screen shot of the interface configurations?

Can you also do a packet capture between a working connection and a non-working connection and upload those for analysis?

[sanderl]

Hi Graham, thanks for helping out. I have no active subscription on this device so I would not be able to contact support right?

Attached screenshot:

Some remarks about the screenshot:

same DNS server is no difference (now used google), tried some with LLDP on/off, currently the port 10 is not connected to the AP anymore

Packet capture is given here:

Trace Logging (failing):

https://dpaste.org/a8SOU

phone (192.168.1.175) connected to lan hardware switch failing to start roblox (DNS servers are on same subnet as phone).

Trace Logging (succesfull):

https://dpaste.org/kcoba

phone (192.168.99.2) connected to vlan99 succeeding to start robox. (DNS servers on lan, thus extra DNS traffic appended).

Or did you mean else?

[gfleming]

Yes I meant an actual packet capture like from Wireshark from the client itself.

Can you also show your SSID and bridge configurations?

[sanderl]

When I have some more time I will capture.

Both ssids are on the same ap... of which the left is bridged directly on the lan switch (with an ip address and dhcp scope). the test99 is bridge into 99.

I had this running for around 3 years or so, on many FortiOS versions and just recently these vague problems started.

In the mean time, as I discovered a "newly" created hardwareswitch with an ssid bridge to that (with a new vlan) does work, I an now in the phase of migrating everything to a new harwareswitch and vlans.

It is a hassle due to the "refs" connected to everything and CLI is a too big risk to change...

so I would really hope to find out why this suddenly startedand is so clearly releated to my "old" hardwareswitch. --> it is not only wifi traffic having problems, also fixed (wired) devices connected directly to this hardwarswitch have vague conneciton problems.

Luckily Roblox is the most "picky" one with which I can easily prove something is wrong when conected to lan. And again, all is right on test99...

Attached but ssid configs: