Ferritaas Incident Intelligence
Defect Intelligence Report Bug 0878120 Severity: High (P2)

SD-WAN Direct Internet Breakout (DIA) Asymmetric Routing Dropping Return ACK

FortiOS kernel session state machine and strict Reverse Path Forwarding (RPF) checks silently drop return TCP SYN-ACK and ACK packets arriving over hub VPN tunnels when client traffic egresses via Direct Internet Breakout (DIA), freezing user web applications and SaaS connections.

🚀 Open Full Runbook #14 & Live Automation on Ferrite → Browse Known Issues Directory
⏱️ Est. Triage: 8–10 mins | Automated CLI Available

Technical Root Cause Analysis

In branch SD-WAN topologies utilizing Direct Internet Breakout (DIA) alongside redundant IPsec overlays to centralized corporate hubs, outbound sessions originate on the local branch network and egress via local physical WAN members (wan1 or wan2).

When external servers, CDNs, or corporate SaaS proxies return traffic via the corporate datacenter instead of the direct internet path, packets ingress the branch firewall on the virtual IPsec interface (e.g., advpn-hub). FortiOS kernel session management looks up the existing stateful session, evaluates the ingress interface against the Forwarding Information Base (FIB), and triggers strict RPF verification.

Because the expected reverse path points out the local DIA WAN interface rather than the IPsec overlay, the kernel marks the session dirty, flags an RPF failure, and silently discards the return packet without generating an ICMP unreachable error.

id=20085 trace_id=149 func=print_pkt_detail line=5810 msg="vd-root:0 received a packet(proto=6, 104.18.22.45:443->192.168.10.55:54210) from advpn-hub. flag [S.], seq 391820194, ack 10294812" id=20085 trace_id=149 func=resolve_ip_tuple_fast line=5980 msg="Find dirty session: 0x07f98102, proto=6, 192.168.10.55:54210->104.18.22.45:443" id=20085 trace_id=149 func=__ip_session_run_tuple line=3510 msg="reverse path check fail, drop packet from advpn-hub" id=20085 trace_id=149 func=__ip_session_run_tuple line=3512 msg="gnum=00000000, rpf_check=strict, dev=advpn-hub, expected_dev=wan1"

Affected Firmware & Blast Radius Matrix

FortiOS Branch Vulnerable Builds Confirmed Clean Build Status & Workaround
FortiOS 7.2 7.2.0 – 7.2.6 7.2.7+ / Policy Tuning Apply loose-rpf or policy asymmetric routing
FortiOS 7.4 7.4.0 – 7.4.1 7.4.2+ Upgrade recommended; per-policy asymroute supported
FortiOS 7.0 7.0.0 – 7.0.14 7.0.15+ Set src-check loose on IPsec tunnel interface

Platform Impact: Affects FortiGate 40F, 60F, 70F, 80F, 100F, and 200F branch appliances operating dual-homed SD-WAN with both Direct Internet Breakout and Hub-and-Spoke IPsec ADVPN tunnels.

Step 01: Free Verification CLI (Safe Read-Only)

Execute these diagnostic commands to confirm whether return packets are failing RPF validation and dropping in the kernel session state machine:

Diagnostic Commands

# 1. Filter active sessions for HTTPS web traffic experiencing stall
diagnose sys session filter clear
diagnose sys session filter dport 443
diagnose sys session list

# 2. Inspect active Reverse Path Forwarding (RPF) drop counters
diagnose ip router rpf-check

# 3. Capture real-time packet flow drops on the branch FortiGate
diagnose debug reset
diagnose debug flow filter dport 443
diagnose debug flow show function-name enable
diagnose debug flow trace start 20
diagnose debug enable

Remediation & Workaround Steps (Teaser Preview)

Follow the complete step-by-step remediation guide in the Ferrite interactive platform:

Step 02: Switch Overlay IPsec Interface to Loose RPF Mode

Configure loose Reverse Path Forwarding on the hub VPN interface to permit return packets if any valid route exists in the FIB.

🔒 Interactive CLI Available in Ferrite Runbook #14

Step 03: Enable Granular Policy-Level Asymmetric Routing

Allow asymmetric return traffic exclusively across the branch DIA and corporate hub policies without globally relaxing TCP sequence inspection.

🔒 Interactive CLI Available in Ferrite Runbook #14

Step 04: Enforce SD-WAN Rule Session Stickiness & Hold-Down Timers

Configure hold-down timers on branch SD-WAN steering rules to eliminate mid-session link flips between DIA and corporate MPLS.

🔒 Interactive CLI Available in Ferrite Runbook #14
⚡ Ferrite Platform Superpowers

Execute the Complete Runbook with Live Browser Automation

Connect your branch FortiGate via browser console (Web Serial) or local SSH bridge, verify each command in real-time, generate ready-to-run Tera Term scripts, and export sanitized TAC dossiers.

⚡
Live Browser Automation Direct terminal connection with live step checkoff.
📟
1-Click Tera Term (.ttl) Generate scripts for air-gapped jumpboxes.
🛡️
Zero-Trust Scrubber Scrub serials and credentials in local browser RAM.
📄
TAC P1 Escalation Dossier Standardized evidence export with SHA-256 seal.

Frequently Asked Questions

What causes Bug 0878120 on SD-WAN branch firewalls?

Under DIA breakout, outbound packets leave via WAN1. If CDN or SaaS servers return traffic via corporate datacenter hubs, the return packets arrive on the IPsec tunnel. The kernel strict RPF check detects an interface mismatch and silently drops the return packet.

Does loose RPF disable firewall security inspection?

No. Setting loose RPF on the IPsec tunnel interface ensures the packet source IP has a route in the FIB, while preserving full stateful inspection, antivirus, and IPS engines on all sessions.

Can this be fixed without upgrading firmware?

Yes. Setting src-check loose on the IPsec interface and configuring per-policy asymmetric routing immediately resolves the drop behavior without requiring a device reboot.