Description
The FortiGate unit (shown as FGT2 in the diagram below) in Transparent Mode allows asymmetrical packet forwarding where packets ingress vlanXX_inside and exited vlanXX_outside. When packets return, if they return by vlanYY_outside, the FortiGate unit will forward them to vlanYY_inside.
Diagram
|
PC1 = 1.1.1.10/24
|
DMZ = 1.1.1.1/24
|
FGT1 (NATmode)
|
WAN2
vlanXX = 2.2.2.1/24
vlanYY = 3.3.3.1/24|
|
TRUNK
|
|
DMZ (VLan interfaces, vlanXX_inside, vlanYY_inside)
|
FGT2 (TP mode)
|
WAN2 (Vlan interfaces, vlanXX_outside, vlanYY_outside)
|
Trunk
|
|
Cisco (L3Switch)
vlanXX= 2.2.2.2/24
vlanYY= 3.3.3.3/24 |
Packet Flow
In the example above, the PC with an IP of 1.1.1.10 initiates a ICMP request to 2.2.2.2 on VlanXX. ICMP packet reaches vlanXX_inside, it creates the session and then the packet is forwarded to the vlanXX_outside interface. When it reaches the Cisco L3 router, it routes the packet to VlanYY. The ICMP reply hits the vlanYY_outside interface. The FortiGate unit will find the existing session and forward the packet to vlanYY_inside.
Sniffer
|
FGT2# diagnose sniffer packet any 'host 2.2.2.2' 4
interfaces=[any]
filters=[host 2.2.2.2]
16.900700 vlanxx_inside in arp who-has 2.2.2.2 tell 2.2.2.1
16.900755 vlanxx_outside out arp who-has 2.2.2.2 tell 2.2.2.1
16.900767 wan2 out arp who-has 2.2.2.2 tell 2.2.2.1
16.901415 vlanxx_outside in arp reply 2.2.2.2 is-at 0:11:92:d4:5e:c3
16.901448 vlanxx_inside out arp reply 2.2.2.2 is-at 0:11:92:d4:5e:c3
16.901458 dmz1 out arp reply 2.2.2.2 is-at 0:11:92:d4:5e:c3
22.032498 vlanxx_inside in 1.1.1.10 -> 2.2.2.2: icmp: echo request
22.032545 vlanxx_outside out 1.1.1.10 -> 2.2.2.2: icmp: echo request
22.032556 wan2 out 1.1.1.10 -> 2.2.2.2: icmp: echo request
22.032872 vlanyy_ouside in 2.2.2.2 -> 1.1.1.10: icmp: echo reply
22.032925 vlanyy_inside out 2.2.2.2 -> 1.1.1.10: icmp: echo reply
22.032934 dmz1 out 2.2.2.2 -> 1.1.1.10: icmp: echo reply |
Debug Flow
FGT2# id=20085 trace_id=1 func=resolve_ip_tuple_fast line=3210 msg="vd-root received a packet(proto=1, 1.1.1.10:1280->2.2.2.2:8) from vlanxx_inside."
id=20085 trace_id=1 func=resolve_ip_tuple line=3326 msg="allocate a new session-00000251"
id=20085 trace_id=1 func=br_fw_forward_handler line=339 msg="Allowed by Policy-2:"
id=20085 trace_id=1 func=__if_queue_push_xmit line=208 msg="send out via dev-vlanxx_outside, dst-mac-00:11:92:d4:5e:c3"
id=20085 trace_id=2 func=resolve_ip_tuple_fast line=3210 msg="vd-root received a packet(proto=1, 1.1.1.10:1280->2.2.2.2:8) from vlanxx_inside."
id=20085 trace_id=2 func=resolve_ip_tuple_fast line=3240 msg="Find an existing session, id-00000251, original direction"
id=20085 trace_id=2 func=br_ipv4_fast_cb line=69 msg="enter fast path"
id=20085 trace_id=2 func=__if_queue_push_xmit line=208 msg="send out via dev-dr_vlanxx, dst-mac-00:11:92:d4:5e:c3"
id=20085 trace_id=3 func=resolve_ip_tuple_fast line=3210 msg="vd-root received a packet(proto=1, 2.2.2.2:1280->1.1.1.10:0) from vlanyy_ouside."
id=20085 trace_id=3 func=resolve_ip_tuple_fast line=3240 msg="Find an existing session, id-00000251, reply direction"
id=20085 trace_id=3 func=br_wccp_preroute_handler line=56 msg="state=00008200, indev=12 without wccp"
id=20085 trace_id=3 func=__if_queue_push_xmit line=208 msg="send out via dev-vlanyy_inside, dst-mac-00:09:0f:2d:9c:fc" |
Scope
FortiGate unit in Transparent Mode
Solution
The reply packet can always go through the FortiGate as long as there is a matching session, no matter asymmetric routing configuration. If there is no matching session, it can only go through the FortiGate when asymmetric routing is enabled under the Config System Settings.
Related Articles
Technical Note : How to use "set peer-interface" in Transparent Mode
