FortiGate route lookup for local out traffic

Forum|Forum|2 years ago
July 23, 2024
4 replies
2653 views

Hi,

I've found the following technical tips on how route lookup is handled in FortiGate

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Routing-in-FortiGate-route-lookup-process/ta-p/194047?externalID=FD50169

But I don't think this logic applies in my case.

I've an ipsec remote access VPN, the forticlient initiates the communication with the FGT (my VPN gateway), the FGT receives requests from forticlient on port1, but it sends the responses on port2 (because of an SDWAN rule I have), And I never get the response on my forticlient (I get a connection timeout on the FGT). I can't modify my SDWAN rule, so I've tried to twist this behavior by adding a PBR so that packets coming on port1 are always returned from that same port. The PBR I added never matched, that's why i want to know if Fortigate takes into consideration PBR entries when doing a route lookup for local out traffic

FortiGate

amrit

Staff & Editor

I would recommend using preserve session route on sslvpn interfaces, Please check this article

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Enabling-the-preserve-session-route/ta-p/197976

Additionally you can check this forum

https://community.fortinet.com/t5/Support-Forum/SSL-VPN-dual-interface/td-p/212882

orpgile38

New Member

when it comes to routing it's already like this. on WAN1 I have iBGP with that learnes default route with admin distance 200. and static default route that points to wan2 has admin distance 210. but pings received on wan2 are not answered by fortigate. I guess (not sure) they are dropped since outgoing interface according to routing table (wan1) does not match interface from which fg is supposed to send icmp reply. so I guess some RPF rule fails. I'm just speculating https://speedtest.vet/ .