Unable to route public IP into vdom

[5q46n2te8jPWJY]

Hello

I am a user of Fortigate 7.4.4, with an architecture based on this:

https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/335646/inter-vdom-routing-co...

On my internet connection, connected to my root VDOM, I have two pools of public IPs. One pool (pool1) configured on my interface, and a second pool (pool2) only routed to my Fortigate's WAN interface.

I want to route an IP from pool2 to vdom1 (a child of root). And create a VIP in vdom1.

When I configure this, no packets arrive at the IP:

FG01 # config vdom

FG01 (vdom) # edit root

current vf=root:0

FG01 (root) # diag debug flow filter clear

FG01 (root) #

FG01 (root) # diag debug flow filter proto 1

FG01 (root) #

FG01 (root) # diag debug flow filter addr 42.149.274.112

FG01 (root) #

FG01 (root) # diag debug enable

FG01 (root) #

FG01 (root) # diag debug flow trace start 10

### no log on screen ####

At one point, I created a VIP on the root VDOM with the IP from pool2 that I want to use, and the traffic started arriving (this is not what I want to do in my case, as my vdom1_admin does not have access to the root)

FG01 (root) #

FG01 (root) # diag debug flow trace start 10

FG01 (root) # id=65308 trace_id=107 func=print_pkt_detail line=5942 msg="vd-root:0 received a packet(proto=1, 42.149.274.112:58514->87.14.198.204:2048) tun_id=0.0.0.0 from VLAN_301. type=8, code=0, id=58514, seq=15011."

id=65308 trace_id=107 func=init_ip_session_common line=6127 msg="allocate a new session-020696c8"

id=65308 trace_id=107 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=80000000 gw-0.0.0.0 via root"

id=65308 trace_id=107 func=fw_local_in_handler line=620 msg="iprope_in_check() check failed on policy 0, drop"

id=65308 trace_id=108 func=print_pkt_detail line=5942 msg="vd-root:0 received a packet(proto=1, 42.149.274.112:58514->87.14.198.204:2048) tun_id=0.0.0.0 from VLAN_301. type=8, code=0, id=58514, seq=15012."

id=65308 trace_id=108 func=init_ip_session_common line=6127 msg="allocate a new session-0206996d"

id=65308 trace_id=108 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=80000000 gw-0.0.0.0 via root"

id=65308 trace_id=108 func=fw_local_in_handler line=620 msg="iprope_in_check() check failed on policy 0, drop"

id=65308 trace_id=109 func=print_pkt_detail line=5942 msg="vd-root:0 received a packet(proto=1, 42.149.274.112:58514->87.14.198.204:2048) tun_id=0.0.0.0 from VLAN_301. type=8, code=0, id=58514, seq=15013."

Then, I finally deleted my VIP on the root VDOM, and everything started working correctly

FG01 (root) # diag debug flow trace start 10

FG01 (root) #

FG01 (root) #

FG01 (root) # id=65308 trace_id=115 func=print_pkt_detail line=5942 msg="vd-root:0 received a packet(proto=1, 42.149.274.112:63637->87.14.198.204:2048) tun_id=0.0.0.0 from VLAN_301. type=8, code=0, id=63637, seq=15019."

id=65308 trace_id=115 func=init_ip_session_common line=6127 msg="allocate a new session-0208ac2b"

id=65308 trace_id=115 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=00000000 gw-10.0.0.2 via vlnk_HYP1"

id=65308 trace_id=115 func=__iprope_tree_check line=535 msg="gnum-100004, use addr/intf hash, len=4"

id=65308 trace_id=115 func=fw_forward_handler line=997 msg="Allowed by Policy-3:"

id=65308 trace_id=115 func=ip_session_confirm_final line=3141 msg="npu_state=0x100, hook=4"

id=65308 trace_id=116 func=print_pkt_detail line=5942 msg="vd-HYPERION:0 received a packet(proto=1, 42.149.274.112:63637->87.14.198.204:2048) tun_id=0.0.0.0 from vlnk_HYP0. type=8, code=0, id=63637, seq=15019."

id=65308 trace_id=116 func=init_ip_session_common line=6127 msg="allocate a new session-0208ac2c"

id=65308 trace_id=116 func=get_new_addr line=1274 msg="find DNAT: IP-192.168.1.14, port-63637"

id=65308 trace_id=116 func=fw_pre_route_handler line=191 msg="VIP-192.168.1.14:63637, outdev-vlnk_HYP0"

id=65308 trace_id=116 func=__ip_session_run_tuple line=3487 msg="DNAT 87.14.198.204:8->192.168.1.14:63637"

id=65308 trace_id=116 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=00000000 gw-0.0.0.0 via VLAN_500"

id=65308 trace_id=116 func=__iprope_tree_check line=524 msg="gnum-100004, use int hash, slot=126, len=4"

id=65308 trace_id=116 func=fw_forward_handler line=997 msg="Allowed by Policy-101:"

id=65308 trace_id=116 func=ip_session_confirm_final line=3141 msg="npu_state=0x100, hook=4"

id=65308 trace_id=117 func=print_pkt_detail line=5942 msg="vd-HYPERION:0 received a packet(proto=1, 192.168.1.14:63637->42.149.274.112:0) tun_id=0.0.0.0 from VLAN_500. type=0, code=0, id=63637, seq=15019."

id=65308 trace_id=117 func=resolve_ip_tuple_fast line=6030 msg="Find an existing session, id-0208ac2c, reply direction"

id=65308 trace_id=117 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=00000000 gw-10.0.0.1 via vlnk_HYP0"

id=65308 trace_id=117 func=npu_handle_session44 line=1355 msg="Trying to offloading session from VLAN_500 to vlnk_HYP0, skb.npu_flag=00000000 ses.state=00000200 ses.npu_state=0x00000100"

id=65308 trace_id=117 func=fw_forward_dirty_handler line=443 msg="state=00000200, state2=00000000, npu_state=00000100"

id=65308 trace_id=117 func=__ip_session_run_tuple line=3474 msg="SNAT 192.168.1.14->87.14.198.204:63637"

id=65308 trace_id=118 func=print_pkt_detail line=5942 msg="vd-root:0 received a packet(proto=1, 87.14.198.204:63637->42.149.274.112:0) tun_id=0.0.0.0 from vlnk_HYP1. type=0, code=0, id=63637, seq=15019."

id=65308 trace_id=118 func=resolve_ip_tuple_fast line=6030 msg="Find an existing session, id-0208ac2b, reply direction"

id=65308 trace_id=118 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=00000000 gw-87.14.198.201 via VLAN_301"

id=65308 trace_id=118 func=npu_handle_session44 line=1355 msg="Trying to offloading session from vlnk_HYP1 to VLAN_301, skb.npu_flag=00000000 ses.state=00000200 ses.npu_state=0x00000100"

It worked for a few hours, then it stopped working.

If I repeat the VIP creation/deletion step on the root VDOM, it works again for a few hours.

legend : 42.149.274.112 IP of my home

              87.14.198.204 public ip I want to use

              87.14.198.201 gateway

              192.168.1.14 private ip of my ressource

Do you have an idea ?

[mpapisetty]

@5q46n2te8jPWJY,

Few things are bit confusing to me. Could you share the relevant IP Pool configs from your root VDOM and also the the VIP configuration that you are creating and deleting? Based on the non-working debug, it looks like the root vdom is treating 87.14.198.204  as it's own local IP instead of performing a route look-up. This can happen if you do not have "set arp-reply disable" on the VIP/pool configuration.