Skip to main content
nvdokh
nvdokh
New Member
February 6, 2024
Question

Incoming connection only accepted on the highest priority WAN

  • February 6, 2024
  • 5 replies
  • 3838 views

I have 2 WAN connections. Both with distance of 10 but with different priorities. However, after upgrading to 7.4.2, only the “active” WAN with highest priority (lower number) accepts incoming connections (admin, VPN, etc.)

 

Any idea how to fix this or what has changed from 7.4.0 to 7.4.2?

5 replies

rosatechnocrat
rosatechnocrat
Explorer III
February 6, 2024

Dear nvdokh,

 

This is how it works.  If we have multiple routes with same distance but configured different priorities then route with lower priority will be used for forwarding the data. 

 

So you can make the same priority value for all routes if you want ECMP to happen. 

 

You can refer below link to understand different scenarios. 

 

https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/25967/equal-cost-multi-path#Example

Subscribe "ROSA Technocrat" on Youtube for Fortinet Videos and Troubleshooting https://www.youtube.com/@rosatechnocrat
    AEK
    SuperUser
    AEK
    SuperUser
    February 6, 2024

    Can you run this command while connecting to a non-working WAN interface?

    diag snif packet any 'host x.x.x.x' 4

    Where x.x.x.x is the client's public IP.

    AEK
      nvdokh
      nvdokhAuthor
      New Member
      February 19, 2024

      62.145784 wan2 in x.x.x.x.1419 -> 10.100.0.2.1443: syn 2400571139
      62.145976 wan1 out 10.100.0.2.1443 -> x.x.x.x.1419: syn 2733505284 ack 2400571140

      hbac
      Staff
      hbac
      Staff
      February 6, 2024

      Hi @nvdokh,

       

      Are you using SDWAN. Please provide the output of this command "get router info routing-table database". 

       

      Regards, 

        nvdokh
        nvdokhAuthor
        New Member
        February 19, 2024

        Routing table for VRF=0
        S *> 0.0.0.0/0 [10/0] via a.a.a.1, wan1, [11/0]
           *> [10/0] via 10.100.0.1, wan2, [12/0]
           *> [10/0] via 1-Dialup tunnel 10.0.0.1, [102/0]
           *> [10/0] via 2-Dialup tunnel x.x.x.x, [104/0]
        S 0.0.0.0/0 [15/0] via 2-Dialup tunnel y.y.y.y, [1/0]
        C *> 10.0.0.0/24 is directly connected, internal
        C *> 10.0.250.0/24 is directly connected, Guest
        C *> 10.100.0.0/24 is directly connected, wan2
        C *> a.a.a.0/24 is directly connected, wan1

        hbac
        Staff
        hbac
        Staff
        February 19, 2024

        @nvdokh,

         

        Are you using SDWAN? If yes, it matches a bug ID 961796. https://docs.fortinet.com/document/fortigate/7.4.3/fortios-release-notes/236526/known-issues

         

        Regards, 

        AEK
        SuperUser
        AEK
        SuperUser
        February 19, 2024

        You see the traffic is coming from wan2 but is returning via wan1. This will not work.

        If you can't make both wan interfaces with same priority then as suggested by @rosatechnocrat I'd suggest to use policy routing to force the traffic with source IP 10.100.0.2 to return via wan2.

        I actually don't know if this is the best solution but it should work.

        AEK
          nvdokh
          nvdokhAuthor
          New Member
          February 19, 2024

          It didn't solve the issue:

           

          config router policy

             edit 1

                set src "10.100.0.2/255.255.255.0"

                set dstaddr "all"

                set output-device "want2"

             next

          end

          AEK
          SuperUser
          AEK
          SuperUser
          February 19, 2024

          Do you have asymmetric routing or auxiliary session enabled?

          show full system settings | grep asym
          show full system settings | grep aux
          AEK
          nvdokh
          nvdokhAuthor
          New Member
          February 27, 2024

          UPDATE:

           

          Fortinet support notified me that this is a known issue starting 7.4.1 and will be resolved when 7.4.4 comes out in the second half of March 2024.

            Terms & ConditionsAccessibility statement