Technical Tip: Behavior of APN WWAN connection with 'Retrieve default gateway from server' command on the WWAN interface

[sfernando]

Description	This article describes the behavior of the APN network used as the WWAN connection on FortiGate and the behavior of 'Retrieve default gateway from server' on the WWAN interface.
Scope	FortiGate with WWAN connections.
Solution	A brief explanation of the APN network: An APN (Access Point Name) is a crucial setting on mobile devices that determines how they connect to the internet. It acts as a gateway between the mobile network and the internet, allowing the device to access data services. Connection Request: When a mobile device (in this case FortiGate with WWAN) wants to connect to the internet, it sends a connection request to the mobile carrier's network using the APN settings configured on the device(FortiGate). APN Settings: These settings include the APN name, username, password, and server address. They are used to identify the network the device should connect to and the services it can access. Example config for Vodafone UK: config system lte-modem    set status enable    set authtype pap    set apn wap.vodafone.co.uk    set username wap    set passwd wap end Related article: Technical Tip: Setting up Access Point Name (APN) Authentication and Routing: The carrier's network receives the connection request and uses the APN settings to authenticate the device. Once authenticated, the network routes the data packets from the device to the appropriate gateway, allowing access to the internet or other network services. Data Transmission: The mobile carrier's infrastructure handles the routing of data packets between the device and the internet. This process ensures that the device can send and receive data efficiently and securely. Default Gateway behavior: An APN connection does not require a default gateway when connecting to a FortiGate as a WAN link because the APN itself handles the routing of data. The below points describes it. APN Functionality: The APN acts as a bridge between the mobile network and the internet. It includes all necessary settings to establish a connection, such as the network identifier and operator identifier. This setup inherently manages the routing of data packets. LTE Modem Integration: FortiGate devices with integrated LTE modems use the APN settings to connect directly to the mobile network. The modem (FortiGate with WWAN) automatically handles the network routing based on the APN configurations.  Dynamic IP Assignment: When a device (FortiGate with WWAN) connects to a mobile network using an APN, it typically receives an IP address dynamically from the carrier. This dynamic assignment includes the necessary routing information, eliminating the need for a manually configured default gateway. Due to the above-explained behavior of the default gateway, enabling 'Retrieve default gateway from server' on the WWAN interface causes issues as it inserts a default route to the routing table and gets issues with the setting provided by the APN network. As a solution, it is necessary to disable 'Retrieve default gateway from server' on the WWAN interface. FortiGate (port1) # sh full | grep default     set defaultgw enable   <----- Make this disable. When 'Retrieve default gateway from server' is enabled on the interface page as below, it injects a route to the routing table which has an arbitrary value for the default gateway. this causes the traffic to drop. As explained in an APN network the mobile carrier provides the next hop IP and it is not the DHCP server that provides the default gateway.  From below, it is observable that 'Retrieve default gateway from server' is injecting route in the routing table and when it is disabled, it does not. 'Retrieve default gateway from server' = enable.  'Retrieve default gateway from server' = disable. Related articles: Internet Connectivity issues if DHCP is enabled on a LAN port Setting up Access Point Name (APN)