You have a device connected to a Router ( Fortigate for this case ) with two IP’s on different Subnets
- You try and speak to the Device on IP1
- Using best path traversal it comes back on the other IP2
- Due to this, the Packets are out of Sync ( and the Router drops the Requests coming from the other IP as it should of been coming back on IP1 )
- This is to stop this attack https://en.wikipedia.org/wiki/Replay_attack – the firewall tries to ensure symmetry in its traffic by using the same source-destination combination
Solutions
- Disable Anti Replay https://kb.fortinet.com/kb/documentLink.do?externalID=FD47428 , Confirm Access and Communication on IP2 , Disable IP1 , Re-enable Anti Replay
- Remove Gateway for the IP2 and speak to it via the Switch in the same Vlan instead of via a router
- Change the Reply to come back out the same interface with App Config https://unix.stackexchange.com/questions/4420/reply-on-same-interface-as-incoming
Loading...