Unusual routing error

Question

I have 3 FG60E's with route based IPSEC tunnels back to our datacenter.

Once a month or so, they'll suddenly start routing traffic over WAN1 for the private subnet instead of the VPN tunnel interface (viewable in the taffic logs). All three of them do it. None of my Juniper's do (we are slowly converting from SSG-5's)

Routing table has x.x.x.x/x TunnelName distance 1

x.x.x.x/x BackupTunnelonWWAN distance 2

0.0.0.0/0 blackhole distance 200

And the WAN1 interface is DHCP from the ISP, and is set at distance 5.

I can fix it by resetting all the sessions or rebooting the firewall.

How is this possible that it's ignoring the distance settings and an explicit route and instead using the implicit 0.0.0.0 received on the WAN interface? More importantly, how do I stop it?

tanr · Answer

It looks like you've got duplicate destination subnets in your static routes with different distances?

So the route to your "TunnelName" interface will be active, but the route to BackupTunnelonWWAN will be inactive since its a duplicate destination with a greater distance.

Maybe what is happening is that TunnelName goes down temporarily and the traffic then gets routed out whatever default route you have to WAN1 (you didn't list it above) before the BackupTunnelonWWAN becomes active. Since it is then an existing session it doesn't get changed back to your BackupTunnelonWWAN once that becomes active.

You should be able to work around that by setting the routes to both TunnelName and BackupTunnelonWWAN to be the same distance but have different priorities. That way both routes would be kept active.

http://kb.fortinet.com/kb/viewContent.do?externalId=FD32103 discusses this.

Note that you should still have blackhole routes for bogon addresses so that if both of your VPN tunnels go down you don't end up routing vpn traffic out the wan. Discussion at https://forum.fortinet.com/tm.aspx?m=100686.

Sign up

Login with SSO

Login to the community

Login with SSO