Troubleshooting FortiGate routing path and gateway selection

1. Open Network -> Static Route in the FortiGate GUI.

2. Confirm that every destination network is associated with the intended gateway and interface. Add missing entries or remove incorrect entries as necessary. In the example, 10.10.10.0/24 must be reachable through MPLS.

3. Check whether 10.10.10.0/24 is installed in the routing table:

get router info routing-table all | grep 10.10.10.0/24

Alternatively, display the entire routing table:

get router info routing-table all

4. Start a packet sniffer for ICMP traffic involving 10.10.10.16:

diag sniffer packet any 'host 10.10.10.16 and icmp' 4 0

5. From source 172.168.0.100, ping destination 10.10.10.16 and inspect the ingress and egress interfaces. A successful symmetric flow appears as follows:

interfaces=[any]
filters=[host 172.168.0.100 and host 10.10.10.16 and icmp]
11.097441 lan in 172.168.0.100 -> 10.10.10.16: icmp: echo request
11.097557 MPLS out 192.168.244.136 -> 10.10.10.16: icmp: echo request
11.129438 MPLS in 10.10.10.16 -> 192.168.244.136: icmp: echo reply
11.129477 lan out 10.10.10.16 -> 172.168.0.100: icmp: echo reply
12.102049 lan in 172.168.0.100 -> 10.10.10.16: icmp: echo request
12.102085 MPLS out 192.168.244.136 -> 10.10.10.16: icmp: echo request
12.133505 MPLS in 10.10.10.16 -> 192.168.244.136: icmp: echo reply
12.133531 lan out 10.10.10.16 -> 172.168.0.100: icmp: echo reply
13.109669 lan in 172.168.0.100 -> 10.10.10.16: icmp: echo request
13.109708 MPLS out 192.168.244.136 -> 10.10.10.16: icmp: echo request
13.147746 MPLS in 10.10.10.16 -> 192.168.244.136: icmp: echo reply
13.147773 lan out 10.10.10.16 -> 172.168.0.100: icmp: echo reply
14.114213 lan in 172.168.0.100 -> 10.10.10.16: icmp: echo request
14.114249 MPLS out 192.168.244.136 -> 10.10.10.16: icmp: echo request
14.138062 MPLS in 10.10.10.16 -> 192.168.244.136: icmp: echo reply
14.138096 lan out 10.10.10.16 -> 172.168.0.100: icmp: echo reply

6. Review each complete ping as a four-packet flow. The 11.xxxxxx, 12.xxxxxx, 13.xxxxxx, and 14.xxxxxx timestamp groups each represent one ping. The expected direction is:

   • Request: LAN(in) to MPLS(out).
   • Reply: MPLS(in) to LAN(out).

7. If FortiGate selects the wrong path, correct the route, distance, or priority as appropriate.

8. Verify that the destination segment and subnet are correct.

9. Confirm that the FortiGate interface can reach the peer gateway. Set the ping source to the relevant interface IP:

Exe ping-options source <interfaceIP>

10. Check that the peer device has a route back to FortiGate. A request leaving through MPLS(out) but a reply arriving through VPN1(in) is asymmetric and incorrect for this example; the reply should return through MPLS. If FortiGate sends traffic to the correct gateway but receives no response or the response uses another gateway, troubleshoot routing on the peer.

Confirm that 10.10.10.0/24 appears in the routing table through the intended path. In the packet sniffer, requests from 172.168.0.100 to 10.10.10.16 must enter on LAN and leave on MPLS, while replies must enter on MPLS and leave on LAN. Four lines should be visible for each successful ping: inbound request, outbound request, inbound reply, and outbound reply.