Hi,
I'm trying to set up vrrp between a Cisco 800 series ISR and a Fortigate VM firewall. Please see diagram below. Should note this is mainly about the Cisco, not the Fortigate.
I'm having a bit of trouble with the VRRP on the FG. It takes master status but none of my LAN kit can seem to get through it to the internet despite correct policies in place and all working fine for other, non-vrrp, subnets.
Whilst investigating the issue I've noticed something very odd from my Cisco, which is what I want to ask about here. I'll save the rest for the Fortigate forums :)
The priority of the FG is currently higher than the Cisco and, as expected, it has taken over as the master device. Both the cisco and the FG confirm
this with the appropriate show/get commands.
Does anyone have any idea how I could be seeing the below results when running these two commands straight after each other?
RTR-01-VM#ping 192.168.50.3 source 192.168.50.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.50.3, timeout is 2 seconds:
Packet sent with a source address of 192.168.50.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
RTR-01-VM#show arp | inc 50.3
RTR-01-VM#
So you can see I am getting a response from 50.3 (the VRRP VIP) but this IP does not appear in the arp cache at all. Debug output shows that the response arriving at router is definitely coming from the 50.3 address and not the configured interface ip, namely .16
001400: .Oct 4 16:58:29.407 BST: ICMP: echo reply rcvd, src 192.168.50.3, dst 192.168.50.1, topology BASE, dscp 0 topoid 0
From the windows laptop I can see all the appropriate mac-addresses in the arp cache but, ironically, I do not get a ping response from 50.3 (but do get a response from 50.16 and can route to the internet without issue if I manually assign 50.16 as the DG for the laptop)
I've cleared the arp cache on the laptop as well and the 50.3 comes back so the fortigate is definitely answering arp responses for this address with the correct mac address.
Obviously I need to try and figure out why the Fortigate doesn't seem to be passing traffic sent to the vrrp address but I'm curious about this missing arp entry in the Cisco.
I considered briefly that the Cisco (being configured with VRRP) just "knows" the VRRP VIP to mac-address mapping so to test I removed the VRRP config from it entirely, no change.
Anyone have any ideas?
