Cant reach Virtual IP from another vlan when using seconder WAN with policy route

[mehmet]

I am having trouble when try to reach a server which is used as a NAT with virtual IP address from the VLAN20. Please could you give me some idea what's holding vlan20 to reach that server?

Debug flow :

id=20085 trace_id=885 func=print_pkt_detail line=5665 msg="vd-root:0 received a packet(proto=6, 192.168.2.3:61108->10.10.10.2:443) from ENKA SITE. flag [S], seq 3245614174, ack 0, win 64240"
id=20085 trace_id=885 func=init_ip_session_common line=5836 msg="allocate a new session-00c7d9b0"
id=20085 trace_id=885 func=_pre_route_auth line=106 msg="pre_route_auth check fail(id=0), drop"

My topology is here:

Vlan10 - 192.168.1.0/24
Vlan20 - 192.168.2.0/24

WAN1 : 10.10.10.2/24
WAN2 : 20.20.20.2/24

STATIC ROUTE : WAN1 - 10.10.10.1 - Priority 0
STATIC ROUTE : WAN2 - 20.20.20.1 - Priority 5

Policy Route : Incoming interface: VLAN20 - Source: 192.168.2.0/24 - Destination : 0.0.0.0/0.0.0.0 - Action: Forward Traffic - Outgoing interface: WAN2 - Gateway: 20.20.20.1

Policy Route(communicate between VLANS) : Incoming interface: VLAN20 - Source: 192.168.2.0/24 - Destination : 192.168.1.0/24 - Action: Stop Policy Routing

Firewall Policy

Incoming interface: VLAN10 - Outgoing Interface: WAN1 - Source : 192.168.1.0/24 - Destination: all - Services : ALL - Nat: yes
Incoming interface: VLAN20 - Outgoing Interface: WAN2 - Source : 192.168.2.0/24 - Destination: all - Nat: yes

Incoming interface: VLAN10 - Outgoing Interface: VLAN20 - Source : 192.168.1.0/24 - Destination: 192.168.2.0/24 - Services : ALL - Nat: NO
Incoming interface: VLAN20 - Outgoing Interface: VLAN10 - Source : 192.168.2.0/24 - Destination: 192.168.1.0/24 - Services : ALL - Nat: NO

Virtural IP

name : VNAT - Interface : WAN1 - Type : Static Nat - External IP: 10.10.10.2 - Mapped IP : 192.168.1.10 - Port Forwarding Protcol - TCP - External service Port : 443 - Map to Port 443

Firewall Policy for NAT

Incoming interface: WAN1 - Outgoing Interface: VLAN10 - Source : ALL - Destination: VNAT - Services : ALL - Nat: yes

[mehmet · Accepted solution]

Fixed the issue by adding below firewall policy

Incoming Interface : VLAN20 - Outgoing Interface : WAN2 - Source : ALL - Destination : 10.10.10.2 - Service : ALL - Nat : NO