Skip to main content
fabianovieira
fabianovieira
New Member
December 20, 2024
Question

DNS Unreachable without source-ip configured

  • December 20, 2024
  • 3 replies
  • 2553 views

Hello!

 

I've two ISP link configured on two separate SD WAN rules.

 

When my primary ISP link is activated, the DNS and FortiGuard works only with the "source-ip" configured:

 

Captura de tela 2024-12-20 115307.pngCaptura de tela 2024-12-20 115415.png

 

Everything OK!

 

My problem is when the secondary ISP is activate. The DNS and Fortiguard stop to work(dns unreachable)! In this case, i needed "unset" the "source-ip" to get it working again.

 

My question:

Is there any configuration so that DNS and Fortiguard continue to work on both links? Without having to make these "source-ip" settings manually.

 

3 replies

AEK
SuperUser
AEK
SuperUser
December 20, 2024

Hi Fabia

I guess you have one public IP on the first WAN interface (PPPoE), and pne public IP + one private IP on the second WAN interface.

In that case I recommend one of the two solutions :

  1. Either configure your second WAN interface as PPPoE interface, and you will not use anymore the private IP
  2. Or configure your FG to use a local DNS server instead of using cloudflare & google DNS

In both cases you will unset the source-ip once for all.

AEK
fabianovieira
fabianovieiraAuthor
New Member
December 20, 2024

Hello!

 

My first link(WAN1) is used to access internet and L2L to access my servers on external datacenter.

 

My second link(WAN2) is used to backup link and used to supply internet to guest vlans.

 

I'll try to configure a local DNS Server, thanks!

cjackson_ncl
cjackson_ncl
Explorer II
December 20, 2024

How do you have the interface select method configured? In cli;

 

config system dns

set interface-select-method sd-wan

 

By default this would be set to auto

fabianovieira
fabianovieiraAuthor
New Member
December 20, 2024

Hello!

 

I've already tested this configuration "set interface-select-method sd-wan". Not works in my case!

 

Theo4
Theo4
Explorer
December 22, 2024

Have you tried investigating why you have to configure "source-ip" in the first place? It's better to find out what the problem is first before looking for the solution. you may have misconfigured routing or SD-WAN rules. 

 

Try removing "source-ip" configuration while the primary ISP is active, and run sniffer and debug flow commands on FGT to trace the local-out DNS traffic and share the output here

Terms & ConditionsAccessibility statement