I apologize if this has been covered before, but I couldn't come up with it in the searches I tried.
I have a fortigate 60E set up as such:
VirtualServer 10.200.1.1
- 10.1.1.130
- 10.1.1.131
- 10.1.1.132
- 10.1.1.133
When any of the machines in the VServer group make a request against the VServer, if they happen to get DNatted to their own IP, the traffic is dropped. Here is the relevant capture snippet:
2017-10-22 14:20:17 id=20085 trace_id=615 func=print_pkt_detail line=5319 msg="vd-root received a packet(proto=6, 10.1.1.130:35704->10.100.1.1:80) from internal. flag, seq 3767787518, ack 0, win 29200", seq 3767797518, ack 0, w
2017-10-22 14:20:17 id=20085 trace_id=615 func=init_ip_session_common line=5475 msg="allocate a new session-02f75ea4"
2017-10-22 14:20:17 id=20085 trace_id=615 func=fw_pre_route_handler line=182 msg="VIP-10.1.1.130:3000, outdev-unkown"
2017-10-22 14:20:17 id=20085 trace_id=615 func=__ip_session_run_tuple line=3140 msg="DNAT 10.100.1.1:80->10.1.1.130:3000"
2017-10-22 14:20:17 id=20085 trace_id=615 func=vf_ip_route_input_common line=2578 msg="find a route: flag=04000000 gw-10.1.1.130 via internal"
2017-10-22 14:20:17 id=20085 trace_id=615 func=ip_session_core_in line=5839 msg="same src/dst address 10.1.1.130, drop"
I've tried creating a policy to allow traffic from 10.1.1.130 to itself, but it still seems to get implicitly dropped. Has anyone else run into this issue? Thanks in advance!
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1714 | |
1093 | |
752 | |
447 | |
232 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.