Troubleshooting Tip: Replay detection errors when SD-WAN rule uses Lowest cost (SLA) with load balancing enabled

Resolution:

• Keep the Lowest cost (SLA), but disable Load balancing in the SD-WAN rule for IPsec traffic.

• Change the Interface Selection Strategy to Best Quality, then only 1 member will be selected.

• Assign different cost values to each IPsec member (for example, 10 and 20). This ensures only one tunnel is active at a time, preventing duplicate SAs and replay detection.

config system sdwan
    config members
        edit 1
            set interface "HUB1"
            set cost 10
        next
            edit 2
                set interface "HUB2"
                set cost 20
            next
        end
    end

• Replay detection must be disabled under Phase 2 when the Lowest Cost (SLA) rule is retained with Load Balancing enabled.

FGT (phase2-interface) # edit HUB1

FGT (HUB1) # show
name : HUB1
phase1name : HUB1
proposal :
replay : enable <----- Disable.
keepalive : disable
auto-negotiate : disable
inbound-dscp-copy : phase1
auto-discovery-sender: phase1
auto-discovery-forwarder: phase1
keylife-type : seconds
encapsulation : tunnel-mode
comments :
src-addr-type : subnet
dst-addr-type : subnet
keylifeseconds : 43200

Key point:
Load balancing with equal-cost IPsec members sends traffic over multiple tunnels simultaneously, which triggers replay detection on the remote peer.