error - reverse path check fail, drop

[JLopezM22]

Hi everyone

We're trying to connect 2 sites with an VPN IPSEC. with the tunnel up and working. we have the next issue:

Scenario:

Triying to connect 192.168.0.102 --> 10.58.152.10

Having the following issue:

Anyone can help please?

[sagha]

Hi, 

Please provide the output for the following: 

get router info routing-table details 192.168.0.102 

get router info routing-table details 10.58.152.10

Once you share these outputs, we can clarify what might be going wrong here.

Thank you. 

Shahan

[JLopezM22]

Routing table for VRF=0
Routing entry for 192.168.0.0/22
Known via "connected", distance 0, metric 0, best
* is directly connected, VLAN-A.

FGT01 (root) ## get router info routing-table details 10.58.152.1

Routing table for VRF=0
Routing entry for 10.58.152.0/24
Known via "static", distance 10, metric 0
10.58.152.1, via port14

Routing entry for 10.58.152.0/24
Known via "connected", distance 0, metric 0, best
* is directly connected, port14

[sagha]

Hi, 

If you could see that there is no route for 192.168.0.102 via IPsec Interface, that is why you are seeing reverse path check. 

Routing table for VRF=0
Routing entry for 192.168.0.0/22
Known via "connected", distance 0, metric 0, best
* is directly connected, VLAN-A.

You are receiving the traffic from source interface IPsec and you should also have a route that points at the Ipsec interface for 192.168.0.102. 

Please add a static route and it should fix this. 

Thanks, 

Shahan

[JLopezM22]

now i have the following

KS-SS-01 (root) # get router info routing-table details 192.168.0.102

Routing entry for 192.168.0.0/22
  Known via "connected", distance 0, metric 0, best
  * is directly connected, VLAN_A
  * is directly connected, VLAN_A
  * is directly connected, VLAN_A

Routing entry for 192.168.0.0/22
  Known via "static", distance 10, metric 0
    directly connected, IPSEC-A

KS-SS-01 (root) # get router info routing-table details 10.58.152.10

Routing table for VRF=0
Routing entry for 10.58.152.0/24
  Known via "static", distance 9, metric 0
    10.58.152.1, via port14

Routing entry for 10.58.152.0/24
  Known via "connected", distance 0, metric 0, best
  * is directly connected, port14

[sagha]

Hi, 

I would suggest adding a more specific route as in this case connected route via VLAN_A would be preferred. May be you can test with adding a route only for 192.168.0.102/32. 

Thanks, 

Shahan

[sagha]

Hi, 

You can also check the following article for details: https://community.fortinet.com/t5/FortiGate/Technical-Note-Details-about-FortiOS-RPF-Reverse-Path-Fo...

Thank you. 

Shahan

[JLopezM22 · Accepted solution]

Finally solved restoring backup :)