SNAT not working with software switch but with hardware switch (vlan switch)
I try to connect from Computer 1 to Server 2.
There is a static Route in the Fortigate for the Network 192.168.250.0/24 pointing zu 192.168.47.254.
I have a SNAT-Rule in place (Central SNAT) which is nating the Computer 1 IP with an IP Pool (IP 192.168.47.50 is free on that network):
Now, this does work with a hardware switch (vlan switch), but i need to inspect the traffic between Server 1 and Server 2, so i use a software Switch with intra-switch-policy explicit now.
Server 1 und Server 2 can connect to each other without an issue. But Computer 1 and Server 2 can't.
I have done a diag with these settings:
diag debug flow filter addr 192.168.250.20
diag debug flow show iprope enable
diag debug flow trace start 100
diag debug enable
And found the Error message:
id=65308 trace_id=1291 func=resolve_ip_tuple_fast line=6070 msg="Find a candidate session id-01a1792d dir=1 hook=4 act=0, tuple not match, drop"
What is the issue here? I have no access to Router 192.168.47.254 so i need to SNAT the traffic as the Server 2 / Router won't know the Subnet 192.168.1.0/24
Maybe someone know what's the issue here? And why is it working with a hardware switch (vlan switch) but not with a software switch?
Regards,
Michael
Full Diag-Log:
id=65308 trace_id=1290 func=print_pkt_detail line=6005 msg="vd-vdom01:0 received a packet(proto=1, 192.168.1.50:1->192.168.250.20:2048) tun_id=0.0.0.0 from Clients. type=8, code=0, id=1, seq=1491."
id=65308 trace_id=1290 func=resolve_ip_tuple_fast line=6107 msg="Find an existing session, id-01a1792d, original direction"
id=65308 trace_id=1290 func=__iprope_fwd_check line=810 msg="in-[Clients], out-[Software-Switch-Server], skb_flags-02000000, vid-0, app_id: 24466, url_cat_id: 0"
id=65308 trace_id=1290 func=__iprope_tree_check line=524 msg="gnum-100004, use int hash, slot=58, len=12"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-100004 policy-1, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-100004 policy-64, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-100004 policy-2, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-100004 policy-38, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-100004 policy-37, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-100004 policy-62, ret-matched, act-accept"
id=65308 trace_id=1290 func=__iprope_user_identity_check line=1903 msg="ret-matched"
id=65308 trace_id=1290 func=__iprope_check line=2404 msg="gnum-4e22, check-ffffff800071c0d4"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-4e22 policy-10, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-4e22 policy-11, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-4e22 policy-12, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-4e22 policy-1, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-4e22 policy-14, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-4e22 policy-5, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-4e22 policy-16, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-4e22 policy-2, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-4e22 policy-3, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-4e22 policy-4, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-4e22 policy-8, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-4e22 policy-6, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-4e22 policy-6, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-4e22 policy-6, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-4e22 policy-7, ret-matched, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2374 msg="policy-7 is matched, act-accept"
id=65308 trace_id=1290 func=__iprope_check line=2421 msg="gnum-4e22 check result: ret-matched, act-accept, flag-00202000, flag2-00000000"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2374 msg="policy-62 is matched, act-accept"
id=65308 trace_id=1290 func=__iprope_fwd_check line=847 msg="after iprope_captive_check(): is_captive-0, ret-matched, act-accept, idx-62"
id=65308 trace_id=1290 func=iprope_reverse_dnat_check line=1353 msg="in-[Clients], out-[Software-Switch-Server], skb_flags-02000000, vid-0"
id=65308 trace_id=1290 func=iprope_reverse_dnat_tree_check line=916 msg="len=0"
id=65308 trace_id=1290 func=iprope_central_nat_check line=1376 msg="in-[Clients], out-[Software-Switch-Server], skb_flags-02000000, vid-0"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-10000d policy-9, ret-matched, act-accept"
id=65308 trace_id=1290 func=get_new_addr line=1231 msg="find SNAT: IP-192.168.47.181(from IPPOOL:IP-Pool)"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2374 msg="policy-9 is matched, act-accept"
id=65308 trace_id=1290 func=iprope_shaping_check line=974 msg="in-[Clients], out-[Software-Switch-Server], skb_flags-02000000, vid-0"
id=65308 trace_id=1290 func=__iprope_check line=2404 msg="gnum-100015, check-ffffff800071acf0"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-100015 policy-2, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-100015 policy-1, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-100015 policy-4, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-100015 policy-5, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-100015 policy-6, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check_one_policy line=2140 msg="checked gnum-100015 policy-3, ret-no-match, act-accept"
id=65308 trace_id=1290 func=__iprope_check line=2421 msg="gnum-100015 check result: ret-no-match, act-accept, flag-00000000, flag2-00000000"
id=65308 trace_id=1290 func=iprope_policy_group_check line=4903 msg="after check: ret-no-match, act-accept, flag-00000000, flag2-00000000"
id=65308 trace_id=1290 func=__ip_session_run_tuple line=3512 msg="SNAT 192.168.1.50->192.168.47.181:60502"
id=65308 trace_id=1290 func=__if_queue_push_xmit line=397 msg="send out via dev-port2, dst-mac-68:87:c6:c1:06:d2"
id=65308 trace_id=1291 func=print_pkt_detail line=6005 msg="vd-vdom01:0 received a packet(proto=1, 192.168.250.20:60502->192.168.47.181:0) tun_id=0.0.0.0 from port2. type=0, code=0, id=60502, seq=1491."
id=65308 trace_id=1291 func=resolve_ip_tuple_fast line=6107 msg="Find an existing session, id-01a1792d, reply direction"
id=65308 trace_id=1291 func=__ip_session_run_tuple line=3525 msg="DNAT 192.168.47.181:0->192.168.1.50:1"
id=65308 trace_id=1291 func=resolve_ip_tuple_fast line=6070 msg="Find a candidate session id-01a1792d dir=1 hook=4 act=0, tuple not match, drop"
Posted Sep 13, 2025, 10:41 PM UTC
227