NOTE: FortiNAC is now named FortiNAC-F. For post-9.4 articles, see FortiNAC-F. FortiNAC is a zero-trust network access solution that provides users with enhanced visibility into the Internet of Things (IoT) devices on their enterprise networks.
Article Id 191638
NAC server with multiple ethernet interfaces not processing inbound packets to eth0 that have a return path of eth1 (or vice versa).  

As of CentOS 6 and later, such traffic is discarded by default.  Refer to Red Hat Solution 53031: "Why does Red Hat Enterprise Linux 6 and above invalidate / discard packets when the route for outbound traffic differs from the route of incoming traffic?"

In an environment where asymmetric routing occurs, this change can potentially result in issues with agent communication and Captive Portal access.

Version:  CentOS 7

Workaround:  Ideally, asymmetric routing should be avoided.  However, there are two ways via CLI to configure the system to accept asymmetrically routed traffic on CentOS 7 such that the system functions similar to CentOS 5.

Temporary change (will revert upon reboot):

This can be changed during runtime by running the following commands:
echo 2 > /proc/sys/net/ipv4/conf/default/rp_filter
echo 2 > /proc/sys/net/ipv4/conf/all/rp_filter

Persistent change:

To make this behavior persistent across reboots, modify /etc/sysctl.conf and make the following change prior to reboot:
net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.all.rp_filter = 2

Solution:  Set static routes in the Application server for eth1.  Refer to related KB article below.

Related Articles

Technical Note: Set static routes using in Configuration Wizard