FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
shaznita
Staff
Staff
Article Id 195997
Description
This article concerns PPTP traffic being unable to establish when passed through the SLBC solution.

PPTP traffic is using PPTP protocol and GRE tunneling.  Traffic for this PPTP protocol and GRE tunneling was load balanced by two different blades that caused the PPTP traffic to be unable to connect to the PPTP server.

Scope
FortiController SLBC, v5.2.4

Solution
Apply the following configuration to the FortiController to make sure that all PPTP traffic is being processed by the Master blade only.
#config load-balance protocol-pin
#set pptp –mode enable
#end

Ensure also that gre-session is not load balanced by the FortiController as well by using the following command.
#config load-balance session-setup
(session-setup)# get
fragment            : disable
gre-session         : disable -> this is disabled so gre traffic will not be load balanced and will be processed by config master only
gtp-session         : disable
ipsec-session       : forward-to-master
load-distribution-method: src-dst-ip-sport-dport
sctp-session        : disable
session-helper      : enable
tcp-ingress         : disable
udp-ingress         : disable
udp-session         : remote

Contributors