Skip to main content
AndreaJulianos
AndreaJulianos
Visitor III
July 15, 2025
Question

Virtual Server Load Balancing Not Working Across VPN Tunnel Between Two Subnets

  • July 15, 2025
  • 2 replies
  • 904 views

 I have two network segments: 10.100.x.x and 10.200.x.x networks. I've successfully established a VPN tunnel between these two different subnets using Fortinet FortiGate-60F(SD-WAN). I have configured a virtual server with the following setup:

  • Virtual IP: 10.200.0.250
  • Mapped to real servers: 10.200.0.102 and 10.100.0.102
  • Health check is configured for both servers

Issue: When I shut down the server at 10.200.0.102, the traffic is not being forwarded to 10.100.0.102 as expected. The load balancing/failover mechanism doesn't seem to be working across the VPN tunnel. Network Topology:

  • 10.200.x.x subnet: FortiGate internal IP 10.200.0.254, Server 10.200.0.102
  • 10.100.x.x subnet: FortiGate internal IP 10.100.0.254, Server 10.100.0.102
  • VPN tunnel: IPSEC connection between the two subnets
  • Virtual IP: 10.200.0.250

Questions:

  1. What could be preventing the traffic from failing over to the cross-subnet server (10.100.0.102)?
  1. Are there specific firewall policies or routing configurations required for virtual servers to work across VPN tunnels?
  1. What troubleshooting steps should I take to identify the root cause?

Any guidance or suggestions would be greatly appreciated. FortiGate Model: FortiGate-60F FortiOS Version: V7.2.6

2 replies

AEK
SuperUser
AEK
SuperUser
July 15, 2025

The remote firewall must allow the local firewall to reach the back-end server (10.100.0.102). You need to add a rule for that on the remote firewall.

Then try connect to the second back-end server (10.100.0.102) from the local firewall to confirm it is reachable on the related service port.

exec telnet 10.100.0.102 443

Hope it helps.

AEK
funkylicious
SuperUser
funkylicious
SuperUser
July 15, 2025

hi, on the virtual server have you configured the real servers as active/standby ?

if so, when you shut down the first server/active , can you confirm that the FGT sees it as down from the Load Balance dashboard ?

if not, try setting inside the virtual server a health check for them.

as for the fw rules, since it uses backend servers towards different subnets and potentially different interfaces, do you have fw rules in place towards them where the destination is the VIP ?

"jack of all trades, master of none"
Terms & ConditionsAccessibility statement