How to Fix FortiGate Asymmetric Routing & Reverse Path Forwarding (RPF) Drops
set src-check disable) or adding a paired static route.
PortalPilot sits inside your browser alongside FortiPortal and FortiGate to explain routing drops, threat scores, and policy issues in plain English—no manual CLI digging required.
🔍 What the FortiOS Flow Debug Shows
id=20085 trace_id=12 func=resolve_ip_tuple_fast line=5825 msg="vd-root:0 received a packet(proto=6, 192.168.10.50:54123->10.0.1.10:443) from port2."
id=20085 trace_id=12 func=vf_ip_route_input_common line=2615 msg="Reverse path check fail, drop"
Packet entered on port2, but the FortiGate routing table has the best route to 192.168.10.50 via wan1 or port1. Strict RPF flags this as spoofed traffic.
Disable strict RPF checking on the specific ingress interface rather than disabling stateful TCP inspection globally across the whole firewall.
⚡ Targeted FortiOS CLI Diagnostic & Remediation
Run these commands in FortiGate CLI or include them in your CAB change request ticket:
# Step 1: Diagnose the packet flow in real time
diagnose debug reset
diagnose debug flow filter saddr 192.168.10.50
diagnose debug flow show function-name enable
diagnose debug flow trace start 10
diagnose debug enable
# Step 2: Disable strict RPF check on the specific ingress interface (port2)
config system interface
edit "port2"
set src-check disable
next
end
# Step 3 (Alternative): If asymmetric routing is unavoidable in a transit VDOM
config system settings
set asymmetricroute enable
end❓ Frequently Asked Questions
What causes Reverse Path Forwarding (RPF) drops in FortiGate?
FortiGate performs anti-spoofing Reverse Path Forwarding (RPF) by default. When an inbound packet arrives on Interface A, FortiOS checks whether its routing table would send return traffic back to that source IP via Interface A. If the best route points to Interface B, FortiOS flags an asymmetric route and silently drops the packet.
How do you detect RPF check failures using the FortiOS CLI?
Run FortiOS flow debugging: diagnose debug reset, diagnose debug flow filter saddr <client-ip>, diagnose debug flow show function-name enable, diagnose debug flow trace start 10, diagnose debug enable. Look for the log line Reverse path check fail, drop.
Should you enable asymmetric routing globally on FortiGate?
Enabling global asymmetric routing (config system settings; set asymmetricroute enable; end) bypasses stateful TCP inspection and UTM inspection on out-of-order packets. It is recommended instead to adjust static routing, configure SD-WAN return rules, or set interface-specific RPF to loose (set src-check disable).
Understand Fortinet Telemetry in Seconds with PortalPilot
PortalPilot translates raw FortiGate, FortiOS, and FortiPortal logs into plain-English root causes and change requests. 100% on-device zero-trust execution.