ECMP Load Balancing Method (Spillover) and SSL-VPN Routing

[egauk]

I setup ECMP dual-wan with spillover. However, when doing so it impacted SSL-VPN connectivity.  I need to force SSL-VPN to route out the interface the SSL-VPN is listening on (wan1) instead of the other interface in the dual-wan (port4).  I see the SSL-VPN request come in on wan1, but the FortiGate is sending the response out port4.

port4 spillover 51200

wan1 spillover 71680

port4 default route static distance 120

wan1 default route static distance 120 I followed the guide here: http://cookbook.fortinet....l-vpn-troubleshooting/ and implemented the below, but it did not resolve my issue. This issue can occur when there are multiple interfaces connected to the Internet (for example, a dual WAN). Upgrade to the latest firmware then use the following CLI command: config vpn ssl settings set route-source-interface enable end

FortiGate 100D

FortiOS 5.2.9

Any help you can provide would be appreciated.

[Rafael_Rosseto]

Hi,

Have you solve this?

[egauk]

Not yet, I have a support ticket open with Fortinet but they have been unable to determine the root cause.  My guess is it is a bug in FortiOS.  I assume you are running into the same issue?

[Rafael_Rosseto]

You are right.

In my case, I have problem to use SSL VPN. When I disable ECMP it works fine.

I have this issue few years ago. At this time was that both ISP were in the same vlan in the switch, and Fortigate was making mess with arp. Then we create one vlan to each link and solve.

[egauk]

Interesting, so was the switch on the FortiGate unit or external switch/ISP switch?

[Rafael_Rosseto]

External Switch, that we plug both links didn't have vlan. Then We create 2 vlans (one per link), then it solve.

But Now I have the link (both of them) plugged direct to Fortigate.

[egauk]

Both of our ISP links are plugged into our FortiGate as well.  It sounds like you are still experiencing the issue?  I will let you know what I find out from Fortinet support.

[rdumitrescu]

Hi guys,

I think you have this issue because of this bug in FortiOS 5.2.9:

287871 Administrative HTTPS and SSLVPN access using second WAN interface does not work after upgrade to 5.2.9

[egauk]

Is this bug new to 5.2.9?  I also had the issue in 5.2.8.