Skip to main content
egauk
egauk
New Member
November 4, 2016
Question

ECMP Load Balancing Method (Spillover) and SSL-VPN Routing

  • November 4, 2016
  • 1 reply
  • 8780 views

I setup ECMP dual-wan with spillover. However, when doing so it impacted SSL-VPN connectivity.  I need to force SSL-VPN to route out the interface the SSL-VPN is listening on (wan1) instead of the other interface in the dual-wan (port4).  I see the SSL-VPN request come in on wan1, but the FortiGate is sending the response out port4.

 

port4 spillover 51200

wan1 spillover 71680

 

port4 default route static distance 120

wan1 default route static distance 120 I followed the guide here: http://cookbook.fortinet....l-vpn-troubleshooting/ and implemented the below, but it did not resolve my issue. This issue can occur when there are multiple interfaces connected to the Internet (for example, a dual WAN). Upgrade to the latest firmware then use the following CLI command: config vpn ssl settings set route-source-interface enable end

 

FortiGate 100D

FortiOS 5.2.9

 

Any help you can provide would be appreciated.

    1 reply

    Rafael_Rosseto
    Rafael_Rosseto
    New Member
    November 18, 2016

    Hi,

     

    Have you solve this?

    egauk
    egaukAuthor
    New Member
    November 18, 2016

    Not yet, I have a support ticket open with Fortinet but they have been unable to determine the root cause.  My guess is it is a bug in FortiOS.  I assume you are running into the same issue?

    Rafael_Rosseto
    Rafael_Rosseto
    New Member
    November 18, 2016

    You are right.

     

    In my case, I have problem to use SSL VPN. When I disable ECMP it works fine.

     

    I have this issue few years ago. At this time was that both ISP were in the same vlan in the switch, and Fortigate was making mess with arp. Then we create one vlan to each link and solve.

    Terms & ConditionsAccessibility statement