Recent FortiGate Update 7.4.10 - Static Routes Stopped Working

[groupit]

Hi Guys,

My firewall did an update recently from 7.4.9 to 7.4.10 and since then my static routes have stopped working.  I have a couple of internal routers that route between different subnets.  They were configured a number of years ago, and since then I haven't had any issue with them until now.  The routes are very straight forward - Destination (192.168.50.0/24**  subnet at other side of router) Gateway (192.168.10.10 router IPt) Interface (LAN)  (enabled).  Clients gateways are set to the Fortigate device and everything was fine until the update.  All clients could reach 192.168.50.x without issue.  That's now stopped working.  If I add a static route on the clients direct it works fine.  So issue is definetly at Fortigate.  Also all monitoring of the subnet stop at exact time of update.

Tried removing and re-entering/rebooting, just doesn;t want to work.

Anyone got a similar issue/fix?

Many thanks      

[FortiMentor · Accepted solution]

Hi,

You may be missing a firewall rule that allows data traffic. In firmware 7.4.9, no rule was required for data traffic that was sent in and out on the same interface. In firmware 7.4.10, this behavior seems to have changed. You therefore need a rule that specifies the source and destination interface as LAN.

[FortiMentor · Accepted solution]

Hi,

You may be missing a firewall rule that allows data traffic. In firmware 7.4.9, no rule was required for data traffic that was sent in and out on the same interface. In firmware 7.4.10, this behavior seems to have changed. You therefore need a rule that specifies the source and destination interface as LAN.

[groupit]

Thanks for the heads up.  I looked through the release notes but never found any reference regarding this change.  Perhaps, I missed it.    Thanks again

[FortiMentor · Accepted solution]

The default setting for allow-traffic-redirect and ipv6-allow-traffic-redirect has been changed from enable to disable

https://docs.fortinet.com/document/fortigate/7.4.10/fortios-release-notes/230510/changes-in-default-...

[groupit]

Both solutions are fixes.  So safe to accept both as the solution

[robert_white909]

Why do you think they made the change to disable this by default? I already have polices for one subnet to another, having to create another on its own interface seems redundant. Was this put in place for a fix for the current SSO CVE? It is odd they introduced this now. 

[FortiMentor]

Fortinet wants to increase security by default. When the “allow-traffic-redirect” function is enabled, all traffic to the destination is allowed. When the function is disabled, it ensures that traffic arriving at an interface and forwarded to another router via the same interface requires a firewall policy that explicitly allows this traffic. I don't like the approach of changing the settings after an update and not just when a new firewall configuration is implemented.