Enabling preserve-session-route in SD-WAN Environment?

[LarsBoosNX]

Hey.

We have 2 FG100 Firewalls with a Firmware higher than 7.2 in a HA cluster, and we did discover the feature "preserve-session-route" in our FortiManager documentation.

We're using SD-WAN with different RuleSets, like Microsoft365 Rules and VoIP Rules.

We also using Site2Site VPN to connect multiple sites together.

What type of issue could we face, if we enable "preserve-session-route" in our WAN Interfaces?

I did only discover the knowledge base article, about that feature, but not the downsides or possible problems.

I hope you could provide me with some answers? :)

Best Regards, Lars

[HarshChavda]

Hello @LarsBoosNX ,

Enabling the preserve-session-route feature in your WAN interfaces can lead to suboptimal routing since the session will continue to use the original route even if a better path becomes available.  You are also using SD-WAN with different RuleSets, preserving session routes might interfere with SD-WAN dynamic path selection and routing decisions.

[pminarik]

Assuming you're doing source-NAT on traffic outgoing via your WAN interfaces and each WAN interface uses a different IP for SNAT, the likely result will be... nothing. SNAT-ed sessions are already sticky by default and will either keep using the original egress interface (even if a "better" route becomes available), or will just terminate (if the route for the original interface goes down).

[LarsBoosNX]

Hi.
I discovered a flag Firewall-session-dirty in the advanced settings of my FortiManager. Can this interfere with SD-WAN and their Rules?

For example, I have a SD-WAN Rule which flags at point x, we switch our outbound route through a second WAN Link. Would then the Firewall-session-dirty get this flag and flushes all existing connections, even SNATed, due to the route change?

I have a somewhat interesting behavior, that we have multiple Connection drops and new connects, if two WAN links have nearly exact performance SLAs, and we enabled a load-balance traffic handling. It looks like a "hopping" from one to the next wan link multiple times.

[pminarik]

firewall-session-dirty is not typically changed when using/deploying SD-WAN. Routing change will automatically trigger session being reevaluated for policy match.

Changing this option is typically an action done when one has very very high amounts of traffic and firewall policies, and policies are changed/updated a lot, thus potentially causing CPU strain (changing this option can then alleviate CPU usage).