BGP ECMP Asymmetric Route Drops Under Strict RPF on Dual-WAN Circuits
Multi-homed BGP Equal-Cost Multi-Path (ECMP) configurations experience unexplained packet loss when upstream transit providers route return flows over alternate WAN paths, triggering strict Reverse Path Forwarding (RPF) drops in the FortiOS kernel.
Technical Root Cause Analysis
When FortiGate participates in dual-ISP BGP multi-homing with ECMP enabled, the forwarding information base (FIB) contains multiple valid egress next-hops for the default route or specific destination prefixes. Outbound connections are load-balanced across WAN1 and WAN2 based on a 5-tuple hash.
However, by default, FortiOS applies strict Reverse Path Forwarding (RPF) to interfaces. If WAN1 forwards an outbound request to an external server, but the carrier returns response packets via WAN2, the firewall evaluates WAN2's ingress packet against the routing table. Because the active route-cache entry pinned the destination to WAN1, the kernel drops the return packet with log code reverse path check failed, drop.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.0 | 7.0.0 – 7.0.13 | 7.0.14+ | Set src-check to disable / feasible |
| FortiOS 7.2 | 7.2.0 – 7.2.6 | 7.2.7+ | Apply loose RPF on WAN members |
| FortiOS 7.4 | 7.4.0 – 7.4.1 | 7.4.2+ | Hardware FIB ECMP sync patch |
Platform Impact: Enterprise multi-homed perimeter firewalls with active-active BGP peerings to separate Tier-1 transit providers.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these commands to verify BGP ECMP route states, route cache entries, and session forwarding paths:
Diagnostic Commands
# 1. Verify BGP neighbor states and prefix counts
get router info bgp summary
# 2. Check active multi-path ECMP routes in routing table
get router info routing-table bgp
# 3. Inspect kernel route-cache entries for destination prefix
diagnose ip rtcache list
# 4. Filter active TCP sessions across dual-WAN interfaces
diagnose ip session filter proto 6Remediation & Workaround Steps (Teaser Preview)
Unlock the complete multi-path route convergence runbook in the Ferrite interactive platform:
Frequently Asked Questions
Strict RPF checks drop valid return traffic arriving on alternate WAN interfaces when BGP ECMP multipath routes are distributed across diverse ISPs.
No. Switching to Feasible RPF ensures that packets are only accepted if a legitimate route exists in the routing table, while permitting legitimate multi-path asymmetric return traffic.
FortiOS 7.2.7 and 7.4.2 include enhanced hardware FIB synchronization for multi-path RPF verification.