Local out traffic selects the wrong SDWAN gateway for outgoing traffic ?
Hi, guys,
I am currently using Fortigate 400E with FortiOS v7.0.3, with the SDWAN configuration of 3 internet lines.
I tried to test the destination IP with traceroute/pingtest as the following test cases:
SDWAN configuration:
1. service rule = Maximized
2. SDWAN Mode(load-balance hash-mode=round-robin)
3. load-balance-mode : source-dest-ip-based
4. duplication-max-num : 3
Firewall policy "local-in-policy" :
Forti400e01 (local-in-policy) # show
config firewall local-in-policy
end
My traceroute test ( pingtest is similar )
Case 1 --- Traceroute test by using dedicated internet line
==========================================
Forti400e01 # exec traceroute-options device port3
Forti400e01 # exec traceroute 91.240.118.105
Forti400e01 # exec traceroute-options device port4
Forti400e01 # exec traceroute 91.240.118.105
Forti400e01 # exec traceroute-options device port5
Forti400e01 # exec traceroute 91.240.118.105
Case 2 --- Traceroute test by using SDWAN rule
=============================================
Forti400e01 # exec traceroute-options source 100.100.100.10
Forti400e01 # exec traceroute-options use-sdwan yes
Forti400e01 # exec traceroute 91.240.118.105
Forti400e01 # exec traceroute-options source 222.222.222.22
Forti400e01 # exec traceroute-options use-sdwan yes
Forti400e01 # exec traceroute 91.240.118.105
Forti400e01 # exec traceroute-options source 111.111.111.11
Forti400e01 # exec traceroute-options use-sdwan yes
Forti400e01 # exec traceroute 91.240.118.105
Case 3 -- Traceroute test by using Source IP
==============================================
Forti400e01 # exec traceroute-options source 100.100.100.10
Forti400e01 # exec traceroute 91.240.118.105
Forti400e01 # exec traceroute-options source 222.222.222.22
Forti400e01 # exec traceroute 91.240.118.105
Forti400e01 # exec traceroute-options source 111.111.111.11
Forti400e01 # exec traceroute 91.240.118.105
Test results:
==========
For case 1, every 'traceroute' completes perfectly;
For case 3, most of 'traceroute' completes (around 1 or 2 times failures in 10 times);
For case 2, most of 'traceroute' can not be performed ( 70% number of times failure )
The cause is found in the Route Cache (Forti400e01 # diag ip rtcache list) :
family=02 tab=254 vrf=0 vf=0 type=01 tos=0 flag=00000200
100.100.100.10@0->91.240.118.105@11(port4) gwy=222.222.222.2 prefsrc=0.0.0.0
ci: ref=0 lastused=41 expire=0 err=00000000 used=12 br=0 pmtu=1500
what is the reason the test always goes to the wrong gateway ( from port3 --> port4 ) ?
Any issue of my test ? any suggestion/recommendation ?
With many thanks
Benson