RIP not functioning with Juniper router

[RGTonkin]

First time caller...

Synopsis:

Single FortiGate 100F (running FortiOS v6.4.6) that exists within a Closed Network domain - meaning NO public (internet) access. The FWs purpose is to terminate multiple external ports where all traffic ultimately routes though a single port (Port1) that is connected to a Juniper router.
The Juniper is a legacy router that Only learns/publishes routes with RIP 2...so using another discovery protocol is not an option.

Of note: I have the FW routing traffic, with NAT and SNAT on multiple ports through Port1, so all the port configurations and routes are correct and functional (having to set static routes in the Juniper router for return traffic - till I can get RIP working).

Configuration:

RIP config only through the UI.

I have set 2 networks to publish (IP's here are exmaples)
Networks:

192.168.10.0/255.255.255.0
192.168.20.0/255.255.255.0

Interfaces:

Port1: Send and Receive RIP v2, passive: disabled, Authentication: disabled

Issue:

Juniper router is receiving NO RIP notices and the FW is not processing RIP packets from the Juniper

- fw # get router info routing-table
"No route available"

- fw # get router info rip interface
...
port1 is up, line protocol is up
RIP is not enabled on this interface
...

So looking at the rip config (below), Port1 IS enabled under RIP - which is concerning since the RIP routing-table (above) reports Port1 as NOT enabled (or is that just a red herring ?)

- config router rip
fw (rip) # show
config router rip
config network
    edit 1
        set prefix 192.168.10.0 255.255.255.0
    next
    edit 2
        set prefix 192.168.20.0 255.255.255.0
    next
end
config redistribute "connected"
end
config redistribute "static"
end
config redistribute "ospf"
end
config redistribute "bgp"
end
config redistribute "isis"
end
config interface
    edit "port1"
        set receive-version 2
        set send-version 2
    next
end

end

The next diagnostic commands are based on these article (there are other articles with the same commands):
    https://docs.fortinet.com/document/fortigate/6.4.3/cli-reference/549620/router-rip
    https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-RIP-on-FortiGate-interfaces/...
I know they're not v6.4.6 specific (and I haven't found any specific to 6.4.6), but the commands work.

fw # get router info protocols
Routing Protocol is "rip"

Sending updates every 30 seconds with +/-50%
Timeout after 180 seconds, garbage collect after 120 seconds
Outgoing update filter list for all interface is not set
Incoming update filter list for all interface is not set
Default redistribution metric is 1
Maximum output metric is 15
Redistributing:
Default version control: send version 2, receive version 2
  Interface Send Recv Key-chain
Routing for Networks:
  192.168.10.0/24
  192.168.20.0/24
Routing Information Sources:
  Gateway Distance Last Update Bad Packets Bad Routes
Distance: (default is 120)

Under "Routing Information Sources" - there's no originating gateway address, so guessing that indicates it's not receiving/processing RIP packets?

Running diagnostic command:

fw ## diagnose sniffer packet any "port 520"
interfaces=[any]
filters=[port 520]
26.233044 port1 in x.x.x.x.520 -> 224.0.0.9.520: udp 324
55.877770 port1 in x.x.x.x.520 -> 224.0.0.9.520: udp 324
84.327312 port1 in x.x.x.x.520 -> 224.0.0.9.520: udp 324
113.484259 port1 in x.x.x.x.520 -> 224.0.0.9.520: udp 324
140.999009 port1 in x.x.x.x.520 -> 224.0.0.9.520: udp 324
(x.x.x.x - not exposing this address)

This indicates the FW IS receiving RIP from the Juniper.

Note: statistics on the Juniper indicate NO RIPv2 Updates Received - which is consistent with the diagnostic above

Enabling logging (I'm assuming it's to the cli)

fw # diagnose ip router rip all enable
Debug messages will be on for 30 minutes.

No message Ever show up - and nothing in the Logs : any of them.

All of the documenntation I've read is terse ... all examples of setting up RIP involve communicating only with Fortinet devices - nothing connected to Cisco, Juniper, etc...

    https://docs.fortinet.com/document/fortigate/6.0.0/handbook/106943/simple-rip-example

    https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-RIP-on-FortiGate-interfaces/...

Also, in RIP on Cisco and Juniper, you define the Neighbor - which I assumed would be the Gateway assigned the Port1 (assigned to the Interfaces in the GUI config page for RIP) - but I do not see it defined in the cli.
Now, the rip config Does have a 'neighbor' element, which I have manually set to the Juniper router IP ... to no avail.

Can someone please provide me information/guidance on how one would configure this unit to get RIP working?
Thank you in advance!

[ebilcari]

I see that you have practically tested everything. I found that there is a limitation and a similar behavior while using RIP and VRF. Is this setup using VRF?

[RGTonkin]

Thanks for the reply!

No, not using VRF - all interfaces have the same default VRF ID of 0.

- Glenn

[RGTonkin]

Update:

I have upgraded the Firmware to v7.2.5 build1517, and was able to manually apply the license key.

RIP problem still exists.

[ebilcari]

I did a test in a lab after this time with a Cisco switch and the RIP is working normally in 7.2.4. whit minimal configuration:

config router rip
config network
edit 1
set prefix 10.0.0.0 255.0.0.0
next
end
config redistribute "connected"
set status enable
end
config redistribute "static"
end
config redistribute "ospf"
end
config redistribute "bgp"
end
config redistribute "isis"
end
config interface
edit "port2"
set receive-version 2
set send-version 2
next

and the routing table get populated on both nodes:

GW # get router info routing-table rip
Routing table for VRF=0
R 10.101.20.0/24 [120/2] via 10.0.0.101, port2, 00:09:32, [1/0]
R 10.101.30.0/24 [120/2] via 10.0.0.101, port2, 00:09:32, [1/0]
R 10.101.50.0/24 [120/2] via 10.0.0.101, port2, 00:09:32, [1/0]

on Cisco SW:

IOU-101#show ip rip database
10.0.0.0/8 auto-summary
10.0.0.0/24 directly connected, Ethernet3/3
10.0.10.1/32
[1] via 10.0.0.1, 00:00:07, Ethernet3/3
10.5.0.0/24
[1] via 10.0.0.1, 00:00:07, Ethernet3/3
10.5.11.0/24

I don't think that there is something wrong with the FGT, better check the configuration in Juniper.