|
Verify the step-by-step configuration:
- Check Phase1 and phase2 configuration of ADVPN:
show vpn ipsec phase1-interface
show vpn ipsec phase2-interface
- Verify SD-WAN Configuration:
show system sdwan-link-interface
show system sdwan-link-load-balance
- Monitor ADVPN and SD-WAN status:
diagnose vpn ike gateway list
diagnose vpn ike gateway summary
diagnose vpn ike gateway info <gateway-name>
diagnose sys sdwan link list
diagnose sys sdwan link info <link-name>
diagnose sys sdwan link-monitor status
diagnose sys sdwan link-monitor <link-name>
- Analyze SD-WAN members, health check status and sessions:
diagnose sys sdwan member
diagnose sys sdwan service4 | diagnose sys sdwan service6
diagnose sys sdwan health-check
diagnose sys session list
- Review Logs and Debug Output:
diagnose debug reset
diagnose debug enable
diagnose debug application sdwan -1 | diagnose debug application link-monitor -1 ( for real-time link monitor debugging)
diagnose debug disable
- Check that ADVPN peers are connected to the network:
Make sure that the SD-WAN and ADVPN configurations are consistent across all FortiGates.
Examine the firewall for any rules or regulations that could be preventing SD-WAN or ADVPN traffic.
If there is a routing problem, follow the below steps to determine where the issue lies:
To discover and fix the problem, the erroneous route selection for traffic in ADVPN with SD-WAN requires a methodical approach utilizing commands. It will efficiently identify and fix improper route selection by using the troubleshooting procedures described in this article and the available commands.
- Inspect the traffic flow using packet capture:
diagnose sniffer packet <interface> <filter> 6 0 l
- Examine Traffic Patterns:
Determine which traffic is being misrouted. Also, monitor traffic flow and routing behavior. Form the flow debugs determine incorrect route selection might be continuous or occasional:
diagnose debug flow filter addr <Source IP | Destination IP>
diagnose debug enable
- Verify the active routing table:
get router info routing-table all
- Review the firewall policies and policy route policy:
show firewall policy <----- View the configured firewall policies.
show router policy <----- View the configured policy routes.
diagnose firewall proute list <----- View the policy routes generated by SD-WAN rules.
Related article:
Technical Tip: SD-WAN support for ADVPN
|
