|
The following configuration is assumed:
- SD-WAN zone has as a member, a dynamic IPsec tunnel configured with 'set net device disable'.
- Health-check configure to monitor the reachability of a server over the tunnel.
- Static route over the tunnel and 'set update-static-route enable'
If the monitored server is not reachable anymore, over that particular tunnel, it is seen that the static route is not removed.
This is expected behavior for dynamic tunnels configured with
'set net-device disable'.
The workaround would be to configure the tunnel with 'set net-device enable'.
This is not recommended and, as of FortiOS 7.0.8 and 7.2.1, a check has been introduced and it is not possible anymore to add an IPsec tunnel configured with 'set net-device enable' as a member of an SD-WAN zone.
|
