iprope_in_check failed, drop

[FrankCQI]

Hi, we have a fortigate 60D. I have an access point who must report to a wireless controller on another subnet going through the fortigate. Route are OK as other devices can route traffic just fine between the 2 subnet. It seems the broadcast from the access point to discover the wireless controller are blocked... Here is the result of the debug trace : id=13 trace_id=200 msg=" vd-root received a packet(proto=17, 172.25.18.206:38212->255.255.255.255:38212) from internal." id=13 trace_id=200 msg=" allocate a new session-00000663" id=13 trace_id=200 msg=" iprope_in_check() check failed, drop" Why is it blocked? How Can I allow that traffic? Both subnet are reachable via the " internal" interface of the fortigate.

[emnoc]

No socket found. Drop

What type of device and how many sessions do you normally have ? My 1st guess is ephermal port exhaustation but you can check this via the cli; diag sys session stat | grep ephemera Also look at your total session counts in the 1st line & pay attention to the lash counter. next question have you custom tuned or adjusted any TTL values for the firewall sessions?

[FrankCQI]

I edited my previous post, that error message is not received anymore. Out of curiosity I ran the command you gave me : memory_tension_drop=0 ephemeral=0/61440 removeable=0 ha_scan=0 No custom TTL.

[emnoc]

d=13 trace_id=200 msg=" iprope_in_check() check failed, drop"

What do you have allow under that interface " internal" ; e.g show sys interface internal You need to probably allow CAPWAP if I had to guess. I would double check the interface and the set allowaccess command

[FrankCQI]

Here is the result of the command, seems CAPWAP is allowed : show sys interface internal config system interface edit " internal" set vdom " root" set ip 172.25.18.139 255.255.255.0 set allowaccess ping https ssh http fgfm capwap set type physical set alias " XXXXX" set snmp-index 1 next end

[ShrewLWD]

sounds like you need to enable ' set broadcast-forward enable' to allow that chatter to pass.

[emnoc]

FWIW

172.25.18.206:38212->255.255.255.255:38212

That a local broadcast and properly with a TTL=1, so forwarding that would not help imho .

[Carl_Wallmark]

If the FAP is on another subnet other than the Fortigate, you have two options: 1. Set the IP of the Fortigate in the FAP itself, you can use http://<ip of FAP> to login if you dont want to use the CLI 2. Configure DHCP-options, there is a special dhcp-option which will pass the IP of the controller. For example: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD33978&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=61498781&stateId=0 0 61500094

[ede_pfau]

which will pass the IP to the controller

You probably mean " ...of the controller" . Isn' t it that an IP address in a DHCP option on a Fortigate has to be entered in hex? I remember there were threads about the TFTP server option some time ago where this was mentioned.

[Carl_Wallmark]

yeah, thats what I mean ;) Yep, it used to be in HEX, I dont know if its changed now, never use it.