| Description | This article describes when IPSEC overlay members are added to SD-WAN and have issues with performance SLA being down. |
| Scope | FortiGate SD-WAN SLA. |
| Solution |
FortiGate can still ping the detect server. But the SLA is showing 'dead' for one of the members. The IPSEC overlay member is configured with a similar source interface (Fortigate LAN interface).
Example:
FGTA: A health check shows that ISP18 and ISP19 are alive.
FGTB: A health check shows ISP18 is dead and ISP19 is alive.
Packet capture on ISP18 VPN interface shows no ICMP reply packet for probe sent by 10.250.3.172--->10.220.3.102.
This is due to asymmetric routing enabled in FGTA which causes icmp probe packet in/out via different interfaces.
Note: When the asymmetric route is enabled, the performance SLA will show UP at one end as per FGTA, while the other end FGTB shows as DOWN.
To solve the issue, disable the asymmetric routing in FortiGate (FGTA).
config system settings
Related article: Technical Tip: Differences between asymmetric routing and auxiliary sessions |
