Fortigate SSLVPN client/server will not pass traffic unless "diag firewall iprope flush" is issued.

[aguerriero]

This is across multiple firewall client types running 7.0.12 and 7.2.5.

The VPN head end is running 7.2.5.

When configuring the fortigate as an SSL VPN Client connecting to another fortigate acting as an SSL VPN concentrator the tunnel will come up but traffic will not pass until the command "diag firewall iprope flush" is issued from CLI. Traffic will immediately start passing as soon as the command is issued.

If the device is rebooted the device will again not be able to pass traffic until the command is run.

I guess this command could be scheduled hourly but I would rather identify the issue so the command does not need to be entered at all.

[aguerriero]

The stitch actually ended up breaking some of our logging functions and also broke SSL remote access to any site that performed the iprope flush command.

We ended up enabling HA and setting the management ip on the tunnel interface.

For our specific application we only needed to add this interface on about 500 of our remote firewalls.

[lol]

Hello,

It should be mentioned that the "diagnose firewall iprope flush" command is a hidden command for reasons. It will wipe _all_ policies from the fortigate and leave the iprope table empty. The FortigGate will not have any rules anymore, neither implict nor firewall, proxy or local in policies and will basically act as a router.

This command should not be used on a production firewall unless recommended by support in very rare cases.

It is absolutely not recommended to run it periodically in a script.

Regards