Static route not being added to routing table

[Veky]

Hello, A FortiGate 50B running FortiOS 3.00, MR4 Patch 5 has a PPPoE connection on the internal interface which is used for backup purposes via a IPSec tunnel to the central location. There is a static route in place for the network on the central location where the IPSec tunnel connects. The interface uses ADSL with a fixed unnumbered IP provided by the ISP and it is a backup VPN service over ADSL. All other routing is done by OSPF. All this works fine, however, the 50B was planned for a software upgrade (target was 4.00 MR2 Patch 9). As soon as the unit is upgraded to 3.00 MR5 Patch 1, the static route is not being added to the routing table anymore, and the backup tunnel can' t connect. Can anyone help? Was there a change in MR5? Release notes do not mention anything regarding this. Thank you in advance. Edit: For better clarification: First picture shows 3.00 MR4 Patch 5. The route is there. Second picture shows 3.00 MR5 Patch 1. The route is not there and it is replaced with an OSPF route which is not correct. Gateway 192.168.102.2 is the unnumbered IP of the PPPoE connection.

[emnoc]

what does your config show for the fortigate? config router static ? I would look there 1st and validate your cfg. Maybe it was dropped during the upgrade. ?

[Veky]

I have double checked and it is there in the configuration.

[emnoc]

I have double checked and it is there in the configuration.

So what does your get router info show? and did you ensure the admin-distance is not override via the ospf (110 ) and that next-hop is valid and up? With out a snippet of you cfg, we have no ideal as to how you have it configured. I would start by executing a few get and posting the output get router info routing-table all config router static ; show

[Veky]

Here it is: Through the GUI, static route 1 has a distance of 10. I' ve tried setting both distance and priority for it to 5, but it didn' t help.

config router static
     edit 1
         set device " internal" 
         set dst 192.168.252.0 255.255.255.0
         set gateway 192.168.102.6
     next
     edit 2
         set device " backup" 
         set distance 200
     next
     edit 3
         set device " wan2" 
         set dst 192.168.98.0 255.255.255.0
         set gateway 192.168.2.251
     next
 end
 

get router info routing-table all
 Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
        O - OSPF, IA - OSPF inter area
        N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
        E1 - OSPF external type 1, E2 - OSPF external type 2
        i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
        * - candidate default
 
 O*E2    0.0.0.0/0 [110/10] via 192.168.204.254, wan1, 00:19:44
 O       192.168.1.0/24 [110/20] via 192.168.204.254, wan1, 00:19:44
 C       192.168.2.0/24 is directly connected, wan2
 C       192.168.3.252/32 is directly connected, ppp0
 O       192.168.15.0/24 [110/20] via 192.168.204.250, wan1, 00:19:44
 O E2    192.168.16.0/24 [110/10] via 192.168.204.250, wan1, 00:19:44
 O E2    192.168.17.0/24 [110/10] via 192.168.204.250, wan1, 00:19:44
 O E2    192.168.19.0/24 [110/10] via 192.168.204.248, wan1, 00:19:44
 O       192.168.20.0/24 [110/20] via 192.168.204.248, wan1, 00:19:44
 O       192.168.30.0/24 [110/20] via 192.168.204.254, wan1, 00:19:44
 S       192.168.98.0/24 [10/0] via 192.168.2.251, wan2
 C       192.168.102.6/32 is directly connected, ppp0
 O       192.168.200.0/24 [110/20] via 192.168.204.254, wan1, 00:19:44
 C       192.168.204.0/24 is directly connected, wan1
 O       192.168.250.0/24 [110/20] via 192.168.204.254, wan1, 00:19:44
 O E2    192.168.252.0/24 [110/10] via 192.168.204.250, wan1, 00:19:44
 O       192.168.254.0/24 [110/110] via 192.168.204.254, wan1, 00:19:44
 

[emnoc]

192.168.3.252/32

Q: what is this 2nd connected route on ppp0? Q:also are you enable to ping either from the cli ?

[rwpatterson]

V3 MR4 was as buggy as Florida in August. I would upgrade to something closer to today, and then try to get the kinks worked out...

[Veky]

Q: what is this 2nd connected route on ppp0? Q:also are you enable to ping either from the cli ?

This is the ISPs gateway behind all VPN over ADSL connections. I can ping 192.168.3.252. From other locations on older firmware, the first hop in tracing 192.168.252.0/24 is 192.168.3.252.

exec ping 192.168.3.252
 
 PING 192.168.3.252 (192.168.3.252): 56 data bytes
 
 64 bytes from 192.168.3.252: icmp_seq=0 ttl=255 time=21.9 ms
 
 64 bytes from 192.168.3.252: icmp_seq=1 ttl=255 time=20.8 ms
 
 64 bytes from 192.168.3.252: icmp_seq=2 ttl=255 time=20.1 ms
 
 64 bytes from 192.168.3.252: icmp_seq=3 ttl=255 time=21.0 ms
 
 64 bytes from 192.168.3.252: icmp_seq=4 ttl=255 time=20.4 ms
 
  
 
 --- 192.168.3.252 ping statistics ---
 
 5 packets transmitted, 5 packets received, 0% packet loss
 
 round-trip min/avg/max = 20.1/20.8/21.9 ms
 
  
 exec trace 192.168.3.252
 
 traceroute to 192.168.3.252 (192.168.3.252), 32 hops max, 72 byte packets
 
  1  192.168.3.252  21 ms  19 ms  20 ms

V3 MR4 was as buggy as Florida in August. I would upgrade to something closer to today, and then try to get the kinks worked out...

Already tried that. I upgraded according to Fortinet recommendation. Final firmware was V4 MR2 Patch 9. It behaved exactly the same as V3 MR5 it currently has. :( It' s like starting from V3 MR5 it just refuses to add routes for an interface using PPPoE. I' ve tried adding different routes for the internal interface and none of them was accepted.

[emnoc]

suggestion: PPP typically places a static route between 2xPPP peers. Are you sure your using the correct address for your next-hop? If the interface is configured, up and functional than the next-hop should be in the table and you can apply any static routes to it.

[rwpatterson]

What is your current OSPF setup? Maybe the route is duplicated in OSPF, so it won' t show up as a static...