upgraded from 6.2.2 to 7.0.12, the route behavior of the interface in dhcp mode will be weird

[zxcv3334444]

Hello Fortinet experts, we were upgrading our fortigate from 6.2.2 to 7.0.12, but we lost the access to fortigate after upgrading it to 7.0.12. The following is our interface/static route/routing table configuration :

There are 2 interfaces :
- port1 (10.50.20.225) is in 10.50.20.0/24, default gateway is 10.50.20.1

- port2 (10.50.97.83) is in 10.50.97.0/24, default gateway is 10.50.97.1

6.2.2 interface
== [ port1 ]
name: port1   mode: dhcp    ip: 10.50.20.225 255.255.255.0   status: up    netbios-forward: disable    type: physical   ring-rx: 0   ring-tx: 0   netflow-sampler: disable    sflow-sampler: disable    src-check: enable    explicit-web-proxy: disable    explicit-ftp-proxy: disable    proxy-captive-portal: disable    mtu-override: disable    wccp: disable    drop-overlapped-fragment: disable    drop-fragment: disable    
== [ port2 ]
name: port2   mode: dhcp    ip: 10.50.97.83 255.255.255.0   status: up    netbios-forward: disable    type: physical   ring-rx: 0   ring-tx: 0   netflow-sampler: disable    sflow-sampler: disable    src-check: enable    explicit-web-proxy: disable    explicit-ftp-proxy: disable    proxy-captive-portal: disable    mtu-override: disable    wccp: disable    drop-overlapped-fragment: disable    drop-fragment: disable    
== [ ssl.root ]
name: ssl.root   ip: 0.0.0.0 0.0.0.0   status: up    netbios-forward: disable 

7.0.12 interface
== [ port1 ]
name: port1   mode: dhcp    ip: 10.50.20.225 255.255.255.0   status: up    netbios-forward: disable    type: physical   ring-rx: 0   ring-tx: 0   netflow-sampler: disable    sflow-sampler: disable    src-check: enable    explicit-web-proxy: disable    explicit-ftp-proxy: disable    proxy-captive-portal: disable    mtu-override: disable    wccp: disable    drop-overlapped-fragment: disable    drop-fragment: disable    
== [ port2 ]
name: port2   mode: dhcp    ip: 10.50.97.83 255.255.255.0   status: up    netbios-forward: disable    type: physical   ring-rx: 0   ring-tx: 0   netflow-sampler: disable    sflow-sampler: disable    src-check: enable    explicit-web-proxy: disable    explicit-ftp-proxy: disable    proxy-captive-portal: disable    mtu-override: disable    wccp: disable    drop-overlapped-fragment: disable    drop-fragment: disable    
== [ ssl.root ]
name: ssl.root   ip: 0.0.0.0 0.0.0.0   status: up    netbios-forward: disable 

static route

6.2.2 static route
config router static
    edit 1
        set dst 172.16.101.0 255.255.255.0
        set device "port1"
        set dynamic-gateway enable
    next
    edit 2
        set dst 10.14.0.0 255.255.0.0
        set device "port2"
        set dynamic-gateway enable
    next
    edit 3
        set dst 10.15.0.0 255.255.0.0
        set device "port2"
        set dynamic-gateway enable
    next
end

7.0.12 static route
config router static
    edit 1
        set dst 172.16.101.0 255.255.255.0
        set device "port1"
        set dynamic-gateway enable
    next
    edit 2
        set dst 10.14.0.0 255.255.0.0
        set device "port2"
        set dynamic-gateway enable
    next
    edit 3
        set dst 10.15.0.0 255.255.0.0
        set device "port2"
        set dynamic-gateway enable
    next
end

routing table (The big difference)

6.2.2 routing table
"""
S*      0.0.0.0/0 [5/0] via 10.50.20.1, port1
                  [5/0] via 10.50.97.1, port2
S       10.14.0.0/16 [10/0] via 10.50.97.1, port2
S       10.15.0.0/16 [10/0] via 10.50.97.1, port2
C       10.50.20.0/24 is directly connected, port1
C       10.50.97.0/24 is directly connected, port2
S       172.16.101.0/24 [10/0] via 10.50.20.1, port1
"""

7.0.12 routing table
"""
S*      0.0.0.0/0 [5/0] is directly connected, port1 [1/0]
                  [5/0] is directly connected, port2 [1/0]
S       10.14.0.0/16 [10/0] is directly connected, port2 [1/0]
S       10.15.0.0/16 [10/0] is directly connected, port2 [1/0]
C       10.50.20.0/24 is directly connected, port1
C       10.50.97.0/24 is directly connected, port2
S       172.16.101.0/24 [10/0] is directly connected, port1 [1/0]
"""

On the Fortigate running 6.2.2, the routing table looks correct, with all the static routes correctly going via the respective gateways. However, on the 7.0.12 version, all the static routes seem to be directly connected to the corresponding ports, rather than going via the respective gateways.

Appreciate for any helps. Thank you.

[saneeshpv_FTNT]

Hi @zxcv3334444 ,

Could you please check if the Firewall is able to retrieve the Gateway information for these interfaces with DHCP ?

Best Regards,

[pgautam]

Hi,

I checked this behavior in the lab on FortiOS 7.0.12.

If FGT is having a gateway IP address in the static route as 0.0.0.0 in the case default route shows directly connected to that port.

Routing table for VRF=0
S* 0.0.0.0/0 [10/0] is directly connected, port1, [1/0]

After getting the proper gateway IP address able to see the gateway IP in the route table as well

Routing table for VRF=0
S* 0.0.0.0/0 [10/0] via 10.5.31.254, port1, [1/0]
[10/0] via 10.5.95.254, port6, [1/0]

Post firewall upgrade have you checked the gateway learned from the DHCP ISP connection?

Regards

Priyanka

- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

[srajeswaran]

Fortigates allows to configure a static route without a gateway as below.

FGT # show router static
config router static
edit 1
set dst 8.8.8.8 255.255.255.255
set priority 3
set device "port4"
next
end

And I can see those routes coming up as "directly connected" without the gateway.

FGT # get router info routing-table details

Routing table for VRF=0
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default

S 8.8.8.8/32 [10/0] is directly connected, port4, [3/0] ====> Here

I believe the same theory applies to your case as well. As mentioned by Priyanka, can you check if you are getting the gateway from DHCP server?

FGT# config system interface

FGT(interface) # edit port4

FGT (port4) # get | grep Gateway
DHCP Gateway : 0.0.0.0

FGT (port4) #

If you are getting the gateway but the routes still don't show the gateway information, it will need further investigation.