Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
5q46n2te8jPWJY
New Contributor III

Unable to route public IP into vdom

Hello
 
I am a user of Fortigate 7.4.4, with an architecture based on this:
 
 
On my internet connection, connected to my root VDOM, I have two pools of public IPs. One pool (pool1) configured on my interface, and a second pool (pool2) only routed to my Fortigate's WAN interface.
 
I want to route an IP from pool2 to vdom1 (a child of root). And create a VIP in vdom1.
 
When I configure this, no packets arrive at the IP:
 
FG01 # config vdom
FG01 (vdom) # edit root
current vf=root:0
FG01 (root) # diag debug flow filter clear
FG01 (root) #
FG01 (root) # diag debug flow filter proto 1
FG01 (root) #
FG01 (root) # diag debug flow filter addr 42.149.274.112
FG01 (root) #
FG01 (root) # diag debug enable
FG01 (root) #
FG01 (root) # diag debug flow trace start 10
### no log on screen ####
 
At one point, I created a VIP on the root VDOM with the IP from pool2 that I want to use, and the traffic started arriving (this is not what I want to do in my case, as my vdom1_admin does not have access to the root)
 
FG01 (root) #
FG01 (root) # diag debug flow trace start 10
 
FG01 (root) # id=65308 trace_id=107 func=print_pkt_detail line=5942 msg="vd-root:0 received a packet(proto=1, 42.149.274.112:58514->87.14.198.204:2048) tun_id=0.0.0.0 from VLAN_301. type=8, code=0, id=58514, seq=15011."
id=65308 trace_id=107 func=init_ip_session_common line=6127 msg="allocate a new session-020696c8"
id=65308 trace_id=107 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=80000000 gw-0.0.0.0 via root"
id=65308 trace_id=107 func=fw_local_in_handler line=620 msg="iprope_in_check() check failed on policy 0, drop"
id=65308 trace_id=108 func=print_pkt_detail line=5942 msg="vd-root:0 received a packet(proto=1, 42.149.274.112:58514->87.14.198.204:2048) tun_id=0.0.0.0 from VLAN_301. type=8, code=0, id=58514, seq=15012."
id=65308 trace_id=108 func=init_ip_session_common line=6127 msg="allocate a new session-0206996d"
id=65308 trace_id=108 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=80000000 gw-0.0.0.0 via root"
id=65308 trace_id=108 func=fw_local_in_handler line=620 msg="iprope_in_check() check failed on policy 0, drop"
id=65308 trace_id=109 func=print_pkt_detail line=5942 msg="vd-root:0 received a packet(proto=1, 42.149.274.112:58514->87.14.198.204:2048) tun_id=0.0.0.0 from VLAN_301. type=8, code=0, id=58514, seq=15013."
 
Then, I finally deleted my VIP on the root VDOM, and everything started working correctly
 
FG01 (root) # diag debug flow trace start 10
 
FG01 (root) #
FG01 (root) #
FG01 (root) # id=65308 trace_id=115 func=print_pkt_detail line=5942 msg="vd-root:0 received a packet(proto=1, 42.149.274.112:63637->87.14.198.204:2048) tun_id=0.0.0.0 from VLAN_301. type=8, code=0, id=63637, seq=15019."
id=65308 trace_id=115 func=init_ip_session_common line=6127 msg="allocate a new session-0208ac2b"
id=65308 trace_id=115 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=00000000 gw-10.0.0.2 via vlnk_HYP1"
id=65308 trace_id=115 func=__iprope_tree_check line=535 msg="gnum-100004, use addr/intf hash, len=4"
id=65308 trace_id=115 func=fw_forward_handler line=997 msg="Allowed by Policy-3:"
id=65308 trace_id=115 func=ip_session_confirm_final line=3141 msg="npu_state=0x100, hook=4"
id=65308 trace_id=116 func=print_pkt_detail line=5942 msg="vd-HYPERION:0 received a packet(proto=1, 42.149.274.112:63637->87.14.198.204:2048) tun_id=0.0.0.0 from vlnk_HYP0. type=8, code=0, id=63637, seq=15019."
id=65308 trace_id=116 func=init_ip_session_common line=6127 msg="allocate a new session-0208ac2c"
id=65308 trace_id=116 func=get_new_addr line=1274 msg="find DNAT: IP-192.168.1.14, port-63637"
id=65308 trace_id=116 func=fw_pre_route_handler line=191 msg="VIP-192.168.1.14:63637, outdev-vlnk_HYP0"
id=65308 trace_id=116 func=__ip_session_run_tuple line=3487 msg="DNAT 87.14.198.204:8->192.168.1.14:63637"
id=65308 trace_id=116 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=00000000 gw-0.0.0.0 via VLAN_500"
id=65308 trace_id=116 func=__iprope_tree_check line=524 msg="gnum-100004, use int hash, slot=126, len=4"
id=65308 trace_id=116 func=fw_forward_handler line=997 msg="Allowed by Policy-101:"
id=65308 trace_id=116 func=ip_session_confirm_final line=3141 msg="npu_state=0x100, hook=4"
id=65308 trace_id=117 func=print_pkt_detail line=5942 msg="vd-HYPERION:0 received a packet(proto=1, 192.168.1.14:63637->42.149.274.112:0) tun_id=0.0.0.0 from VLAN_500. type=0, code=0, id=63637, seq=15019."
id=65308 trace_id=117 func=resolve_ip_tuple_fast line=6030 msg="Find an existing session, id-0208ac2c, reply direction"
id=65308 trace_id=117 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=00000000 gw-10.0.0.1 via vlnk_HYP0"
id=65308 trace_id=117 func=npu_handle_session44 line=1355 msg="Trying to offloading session from VLAN_500 to vlnk_HYP0, skb.npu_flag=00000000 ses.state=00000200 ses.npu_state=0x00000100"
id=65308 trace_id=117 func=fw_forward_dirty_handler line=443 msg="state=00000200, state2=00000000, npu_state=00000100"
id=65308 trace_id=117 func=__ip_session_run_tuple line=3474 msg="SNAT 192.168.1.14->87.14.198.204:63637"
id=65308 trace_id=118 func=print_pkt_detail line=5942 msg="vd-root:0 received a packet(proto=1, 87.14.198.204:63637->42.149.274.112:0) tun_id=0.0.0.0 from vlnk_HYP1. type=0, code=0, id=63637, seq=15019."
id=65308 trace_id=118 func=resolve_ip_tuple_fast line=6030 msg="Find an existing session, id-0208ac2b, reply direction"
id=65308 trace_id=118 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=00000000 gw-87.14.198.201 via VLAN_301"
id=65308 trace_id=118 func=npu_handle_session44 line=1355 msg="Trying to offloading session from vlnk_HYP1 to VLAN_301, skb.npu_flag=00000000 ses.state=00000200 ses.npu_state=0x00000100"
 
It worked for a few hours, then it stopped working.
 
If I repeat the VIP creation/deletion step on the root VDOM, it works again for a few hours.
 
legend : 42.149.274.112 IP of my home
              87.14.198.204 public ip I want to use
              87.14.198.201 gateway
              192.168.1.14 private ip of my ressource
 
Do you have an idea ?
1 REPLY 1
mpapisetty
Staff
Staff

@5q46n2te8jPWJY,

Few things are bit confusing to me. Could you share the relevant IP Pool configs from your root VDOM and also the the VIP configuration that you are creating and deleting? Based on the non-working debug, it looks like the root vdom is treating 87.14.198.204  as it's own local IP instead of performing a route look-up. This can happen if you do not have "set arp-reply disable" on the VIP/pool configuration. 

-Manoj Papisetty
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors