Pings work then stop for no reason

[ddemland]

I am working on a 60D with FortiOS 5.6.6 and I am at a loss, I do not understand what is going on. I have an internal network on interface internal1 and I have a wireless access point on interface internal4. The AP had two SSIDs and each SSID has a different VLAN. The policy routing and firewall allows for traffic from the internal1 interface to the AP interface. However, When I do a ping I get this: C:\Users\ddemland>ping 10.74.250.1 Pinging 10.74.250.1 with 32 bytes of data: Reply from 10.74.250.1: bytes=32 time<1ms TTL=63 Reply from 10.74.250.1: bytes=32 time<1ms TTL=63 Reply from 10.74.250.1: bytes=32 time<1ms TTL=63 Reply from 10.72.250.254: Destination host unreachable. Ping statistics for 10.74.250.1:     Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds:     Minimum = 0ms, Maximum = 0ms, Average = 0ms I cannot figure out why I get some pings then I get a destination unreachable. I have done a trace and this is what I get:id=20085 trace_id=253 func=print_pkt_detail line=5295 msg="vd-root received a packet(proto=1, 10.72.250.50:1->10.74.250.1:2048) from internal1. type=8, code=0, id=1, seq=7918." id=20085 trace_id=253 func=init_ip_session_common line=5454 msg="allocate a new session-00207ec1" id=20085 trace_id=253 func=vf_ip4_route_input line=1589 msg="Match policy routing: to 10.74.250.1 via ifindex-19" id=20085 trace_id=253 func=vf_ip4_route_input line=1599 msg="find a route: flags=00000000 gw-10.74.250.1 via WLAN" id=20085 trace_id=253 func=fw_forward_handler line=737 msg="Allowed by Policy-10:" id=20085 trace_id=254 func=print_pkt_detail line=5295 msg="vd-root received a packet(proto=1, 10.72.250.50:1->10.74.250.1:2048) from internal1. type=8, code=0, id=1, seq=7919." id=20085 trace_id=254 func=resolve_ip_tuple_fast line=5370 msg="Find an existing session, id-00207ec1, original direction" id=20085 trace_id=254 func=vf_ip4_route_input line=1589 msg="Match policy routing: to 10.74.250.1 via ifindex-19" id=20085 trace_id=254 func=vf_ip4_route_input line=1599 msg="find a route: flags=00000000 gw-10.74.250.1 via WLAN" id=20085 trace_id=255 func=print_pkt_detail line=5295 msg="vd-root received a packet(proto=1, 10.72.250.50:1->10.74.250.1:2048) from internal1. type=8, code=0, id=1, seq=7920." id=20085 trace_id=255 func=resolve_ip_tuple_fast line=5370 msg="Find an existing session, id-00207ec1, original direction" id=20085 trace_id=255 func=vf_ip4_route_input line=1589 msg="Match policy routing: to 10.74.250.1 via ifindex-19" id=20085 trace_id=255 func=vf_ip4_route_input line=1599 msg="find a route: flags=00000000 gw-10.74.250.1 via WLAN" id=20085 trace_id=256 func=print_pkt_detail line=5295 msg="vd-root received a packet(proto=1, 10.72.250.50:1->10.74.250.1:2048) from internal1. type=8, code=0, id=1, seq=7921." id=20085 trace_id=256 func=resolve_ip_tuple_fast line=5370 msg="Find an existing session, id-00207ec1, original direction" id=20085 trace_id=256 func=vf_ip4_route_input line=1589 msg="Match policy routing: to 10.74.250.1 via ifindex-19" id=20085 trace_id=256 func=vf_ip4_route_input line=1599 msg="find a route: flags=00000000 gw-10.74.250.1 via WLAN" id=20085 trace_id=274 func=print_pkt_detail line=5295 msg="vd-root received a packet(proto=1, 10.72.250.50:1->10.74.250.1:2048) from internal1. type=8, code=0, id=1, seq=7939." id=20085 trace_id=274 func=resolve_ip_tuple_fast line=5370 msg="Find an existing session, id-00207ec1, original direction" id=20085 trace_id=274 func=vf_ip4_route_input line=1589 msg="Match policy routing: to 10.74.250.1 via ifindex-19" id=20085 trace_id=274 func=vf_ip4_route_input line=1599 msg="find a route: flags=00000000 gw-10.74.250.1 via WLAN" id=20085 trace_id=275 func=print_pkt_detail line=5295 msg="vd-root received a packet(proto=1, 10.72.250.50:1->10.74.250.1:2048) from internal1. type=8, code=0, id=1, seq=7940." id=20085 trace_id=275 func=resolve_ip_tuple_fast line=5370 msg="Find an existing session, id-00207ec1, original direction" id=20085 trace_id=275 func=npu_handle_session44 line=917 msg="Trying to offloading session from internal1 to WLAN, skb.npu_flag=00000400 ses.state=00010200 ses.npu_state=0x00000000" id=20085 trace_id=276 func=print_pkt_detail line=5295 msg="vd-root received a packet(proto=1, 10.72.250.50:1->10.74.250.1:2048) from internal1. type=8, code=0, id=1, seq=7941." id=20085 trace_id=276 func=resolve_ip_tuple_fast line=5370 msg="Find an existing session, id-00207ec1, original direction" id=20085 trace_id=276 func=npu_handle_session44 line=917 msg="Trying to offloading session from internal1 to WLAN, skb.npu_flag=00000400 ses.state=00010200 ses.npu_state=0x00000000" I have no idea why the pings are stopping. What am I missing? Thank You, DavidI am working on a 60D with FortiOS 5.6.6 and I am at a loss, I do not understand what is going on. I have an internal network on interface internal1 and I have a wireless access point on interface internal4. The AP had two SSIDs and each SSID has a different VLAN. The policy routing and firewall allows for traffic from the internal1 interface to the AP interface. However, When I do a ping I get this: C:\Users\ddemland>ping 10.74.250.1 Pinging 10.74.250.1 with 32 bytes of data:Reply from 10.74.250.1: bytes=32 time<1ms TTL=63Reply from 10.74.250.1: bytes=32 time<1ms TTL=63Reply from 10.74.250.1: bytes=32 time<1ms TTL=63Reply from 10.72.250.254: Destination host unreachable. Ping statistics for 10.74.250.1:    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),Approximate round trip times in milli-seconds:    Minimum = 0ms, Maximum = 0ms, Average = 0ms I cannot figure out why I get some pings then I get a destination unreachable. I have done a trace and this is what I get:id=20085 trace_id=253 func=print_pkt_detail line=5295 msg="vd-root received a packet(proto=1, 10.72.250.50:1->10.74.250.1:2048) from internal1. type=8, code=0, id=1, seq=7918."id=20085 trace_id=253 func=init_ip_session_common line=5454 msg="allocate a new session-00207ec1"id=20085 trace_id=253 func=vf_ip4_route_input line=1589 msg="Match policy routing: to 10.74.250.1 via ifindex-19"id=20085 trace_id=253 func=vf_ip4_route_input line=1599 msg="find a route: flags=00000000 gw-10.74.250.1 via WLAN"id=20085 trace_id=253 func=fw_forward_handler line=737 msg="Allowed by Policy-10:"id=20085 trace_id=254 func=print_pkt_detail line=5295 msg="vd-root received a packet(proto=1, 10.72.250.50:1->10.74.250.1:2048) from internal1. type=8, code=0, id=1, seq=7919."id=20085 trace_id=254 func=resolve_ip_tuple_fast line=5370 msg="Find an existing session, id-00207ec1, original direction"id=20085 trace_id=254 func=vf_ip4_route_input line=1589 msg="Match policy routing: to 10.74.250.1 via ifindex-19"id=20085 trace_id=254 func=vf_ip4_route_input line=1599 msg="find a route: flags=00000000 gw-10.74.250.1 via WLAN"id=20085 trace_id=255 func=print_pkt_detail line=5295 msg="vd-root received a packet(proto=1, 10.72.250.50:1->10.74.250.1:2048) from internal1. type=8, code=0, id=1, seq=7920."id=20085 trace_id=255 func=resolve_ip_tuple_fast line=5370 msg="Find an existing session, id-00207ec1, original direction"id=20085 trace_id=255 func=vf_ip4_route_input line=1589 msg="Match policy routing: to 10.74.250.1 via ifindex-19"id=20085 trace_id=255 func=vf_ip4_route_input line=1599 msg="find a route: flags=00000000 gw-10.74.250.1 via WLAN"id=20085 trace_id=256 func=print_pkt_detail line=5295 msg="vd-root received a packet(proto=1, 10.72.250.50:1->10.74.250.1:2048) from internal1. type=8, code=0, id=1, seq=7921."id=20085 trace_id=256 func=resolve_ip_tuple_fast line=5370 msg="Find an existing session, id-00207ec1, original direction"id=20085 trace_id=256 func=vf_ip4_route_input line=1589 msg="Match policy routing: to 10.74.250.1 via ifindex-19"id=20085 trace_id=256 func=vf_ip4_route_input line=1599 msg="find a route: flags=00000000 gw-10.74.250.1 via WLAN"id=20085 trace_id=274 func=print_pkt_detail line=5295 msg="vd-root received a packet(proto=1, 10.72.250.50:1->10.74.250.1:2048) from internal1. type=8, code=0, id=1, seq=7939."id=20085 trace_id=274 func=resolve_ip_tuple_fast line=5370 msg="Find an existing session, id-00207ec1, original direction"id=20085 trace_id=274 func=vf_ip4_route_input line=1589 msg="Match policy routing: to 10.74.250.1 via ifindex-19"id=20085 trace_id=274 func=vf_ip4_route_input line=1599 msg="find a route: flags=00000000 gw-10.74.250.1 via WLAN"id=20085 trace_id=275 func=print_pkt_detail line=5295 msg="vd-root received a packet(proto=1, 10.72.250.50:1->10.74.250.1:2048) from internal1. type=8, code=0, id=1, seq=7940."id=20085 trace_id=275 func=resolve_ip_tuple_fast line=5370 msg="Find an existing session, id-00207ec1, original direction"id=20085 trace_id=275 func=npu_handle_session44 line=917 msg="Trying to offloading session from internal1 to WLAN, skb.npu_flag=00000400 ses.state=00010200 ses.npu_state=0x00000000"id=20085 trace_id=276 func=print_pkt_detail line=5295 msg="vd-root received a packet(proto=1, 10.72.250.50:1->10.74.250.1:2048) from internal1. type=8, code=0, id=1, seq=7941."id=20085 trace_id=276 func=resolve_ip_tuple_fast line=5370 msg="Find an existing session, id-00207ec1, original direction"id=20085 trace_id=276 func=npu_handle_session44 line=917 msg="Trying to offloading session from internal1 to WLAN, skb.npu_flag=00000400 ses.state=00010200 ses.npu_state=0x00000000" I have no idea why the pings are stopping. What am I missing? Thank You, David

[Toshi_Esumi]

Looks like something is wrong with ASIC. As you saw in the flow debugging, after three pings it tried offloading the session to ASIC, which is normal and you wouldn't see it in flow debug any more. But pinging should just keep going as you expect, which is handled by the ASIC from that point.

I would look for bug fixes or known bugs in 5.6.7 release notes if something related is in.

Also I would try disabling ASIC offloading at the policy#10 to verify this is definitely an ASIC issue. And when you confirmed and don't find anything in 5.6.7's release notes, it's time to open a ticket with TAC.

By the way, why do you need to use policy routes? It might be one of conditions for this problem to occur.

[ddemland]

Thank you. You were right, I turned off ASIC on policy 10 and the ping started to work like it should. I did look at the release notes for 5.6.7 and did not see anything that would let me believe this was addressed. I then disabled the policy and everything works perfect. It is clear I need to understand what policy routes are actually used for not what I think they are used for. I am new to Fortinet so do you have any place I can look to learn more about how policy routes should be used?

[Toshi_Esumi]

It's indifferent from any other firewalls in terms of use/needs of policy routes. For a given destination, if one group of traffic needs to go to one way while the rest of traffic needs to take another way, a policy route is needed. Because Layer3 routing, like all routers do, works based on the destination only.

You sounded like you just got involved managing the FGT somebody else had set up. To just route between two local subnets (local LAN and WiFi SSIDs) you regularly don't need any policy routes. As long as a proper route is there for the destination, it's all you need. And the rest is regular FW features if you want to filter or inspect some traffic based on the FW policies. I would start without policy routes.