Layer 2 Communication Failure Between Virtual Appliances.
Article ID: 445776
Updated On:
Products
Issue/Introduction
The Tenable Virtual Appliance fails to communicate via Layer 2 with the WAF Virtual Appliance.
Both VMs reside on the same ESXi host and VLAN.
Packet captures at the ESXi host level show that ICMP echo requests reach the WAF interface, but the ICMP echo replies are incorrectly sent to the physical default gateway's MAC address instead of the source VM.
Environment
vSphere ESX
Cause
A broad HA Policy Route configured on the WAF Virtual Appliance (e.g. FortiWeb) is intercepting local return traffic and incorrectly forcing it to the default gateway, bypassing standard Layer 2 routing behavior for the local subnet.
Resolution
Engage the WAF Virtual Appliance vendor support to resolve the Policy Routing or HA Policy Route configuration issue as it may be different from this scenario:
Create a new, higher-priority policy route (e.g., Priority 100) specifically targeting the destination IP of the Tenable VM.
Configure this new rule to send traffic out the appropriate local interface without specifying a gateway IP.
Save the configuration and verify that bidirectional communication is restored by initiating a ping test between the appliances.
Additional Information
Feedback
