Technical Tip: Local-OUT traffic with specified source

princes · ‎09-12-2024

Description

This article provides information about local out traffic like sending backup to the TFTP server from a specific source address.

Scope

FortiGate.

Solution

By default, if the FortiGate has to send any self-generated traffic, it would choose an interface with a lower index or sometimes it would be a random interface.

In this scenario, the user wants the traffic to the TFTP server via a specific source IP address. The user was using tunnel interface IP as a source to send traffic to the TFTP server.

specify the source in the SD-WAN rule as the tunnel interface IP is not working.:

TO_HQ01-WAN1---->172.15.35.2 (tunnel interface IP).
TFTP server IP: 172.17.40.95
Port configured is 22 for FTP.

Sniffer traffic:

Taif-FW01 # diagnose sniffer packet any "host 172.17.40.95 and port 22" 4 0 l
interfaces=[any]
filters=[host 172.17.40.95 and port 22]
2024-09-05 17:01:23.409651 port3 out 77.240.91.55.1932 -> 172.17.40.95.22: syn 3940763565
2024-09-05 17:01:24.411233 port3 out 77.240.91.55.1932 -> 172.17.40.95.22: syn 3940763565
2024-09-05 17:01:26.411244 port3 out 77.240.91.55.1932 -> 172.17.40.95.22: syn 3940763565
2024-09-05 17:01:30.421245 port3 out 77.240.91.55.1932 -> 172.17.40.95.22: syn 3940763565

In the working scenario, the traffic was going out via a specified source (tunnel interface):

Taif-FW01 # diag sniffer packet any "host 172.17.40.95 and port 22" 4 0 l
interfaces=[any]
filters=[host 172.17.40.95 and port 22]
2024-09-05 12:12:15.801851 TO_HQ01-WAN1 out 172.15.35.2.24834 -> 172.17.40.95.22: syn 1040522457
2024-09-05 12:12:15.825417 TO_HQ01-WAN1 in 172.17.40.95.22 -> 172.15.35.2.24834: syn 4247647085 ack 1040522458
2024-09-05 12:12:15.825439 TO_HQ01-WAN1 out 172.15.35.2.24834 -> 172.17.40.95.22: ack 4247647086

==============================================================================================

The SD-WAN rule was set as below:

The tunnel interface is part of the VPN zone and the source is specified as tunnel interface IP.

If a default route is used for the VPN zone the traffic will be sent out via a random WAN link (from top to bottom SD-WAN rule match).

In this case, if the VPN zone has a default route, the SD-WAN rule should contain the source as all to send the traffic out via the tunnel interface, or if it is necessary to send out traffic via a tunnel interface (or any specific source), it should not have default route with VPN zone :

As defined above, instead of a default route, if a specific route is defined with a VPN zone despite of whatever source in the SD-WAN rule (specific or all), it would always go out via tunnel interface IP.

Note:

In 7.4.x new feature was added to mention a specific source IP in the SD-WAN rule or static route:

Technical Tip: Configuring source IP for local-out traffic