VPN between 2 Fortigates 60E loosing ping packets

[lcmuser]

Hi all,

Checked other forum threads, but found only one mention here https://forum.fortinet.com/tm.aspx?m=142160 and it is not answered.

Basically we have just purchased a pair of Fortigate 60E firewalls that we would like to use for site-to-site IPSec VPN.

So I set them up sitting next to each other connected via a patch cable. 

I used VPN Wizard, everything seems to have started working ok, however.

I am using a cisco switch as a client on one side and a mac laptop on the other. I run continuous ping from Mac to the switch and it appears to be working fine, no timeouts or lost packets. Same thing done from switch side towards Mac looks similarly ok, however if I run a ping with say 10000 repetitions, that shows issues:

Type escape sequence to abort.
Sending 10000, 100-byte ICMP Echos to 172.11.11.99, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!..!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Clearly, some packets get dropped... but why ? No errors in logs....

Any help is appreciated...

[lcmuser]

Quick addition... It appears that the drop event happens after every 250 pings.... is there some sort of protection against constant pings sent in a short time span?

[emnoc]

Should not be but what else might be happening at 250 pings? Does the issues with large and sml pkts? Can you place a ipv4 address on both FGT vpn-interfaces, does the same issue happen if pings are FGT-2-FGT?

What is the PMTU?  ( should be 1438bytes or less typically  ) 

Ken Felix

[lcmuser]

Thanks, but what about this "feature" ?

https://help.fortinet.com/fos50hlp/52data/Content/FortiOS/fortigate-firewall-52/Security%20Policies/...

icmp_floodIf the number of ICMP packets sent to one destination IP address exceeds the configured threshold value, the action is executed.250 packets per second.

To me this looks quite relevant.

I am actually using Cisco switch as a client and it seems to be able to send very many icmp packets per second... and interestingly, according the ping output the issue happens after every 250 responses...

[emnoc · Accepted solution]

Okay so do or did you implement DoS protection. A simple ping is not a DoS by itself

I would 1st start by reviewing  your firewall and see what you applied at the policy and dos-policy level

config firewall  DoS-policy    show full-configuration  And if you have a rule  than look at the icmp-information config firewall DoS-policy    edit 1        config anomaly            edit "icmp_flood" <---                set threshold 250            next            edit "icmp_sweep" <---                set threshold 100            next            edit "icmp_src_session" <---                set threshold 300            next            edit "icmp_dst_session" <---                set threshold 1000            next  Ken Felix 

[lcmuser]

Thanks. Let me check. The thing is - both devices are just out of the box, i have only setup VPN, no other bits apart from the hostname, IP addresses and other basic settings. i'll report on the findings...

[lcmuser]

there seem to be no DoS policy:

VPN01 # config firewall DoS-policy

VPN01 (DoS-policy) # show full-configuration
config firewall DoS-policy
end

VPN01 (DoS-policy) #

I suspect that device has one embedded that probably cannot be changed ?

[lcmuser]

In the end this was all due to the Mac laptop's firewall and nothing to do with Fortigates.

[lcmuser]

Just wondering if this is anything to do with this (https://help.fortinet.com/fos50hlp/52data/Content/FortiOS/fortigate-firewall-52/Security%20Policies/...:(

icmp_floodIf the number of ICMP packets sent to one destination IP address exceeds the configured threshold value, the action is executed.250 packets per second.