FG 81E - SD-wan rule with manual select member does not hit.

[TanLee]

I am using FortiGate 81E, running OS 6.2.3 with the following setup:

- Two WAN ports are connected to the ISP using PPPoE mode. WAN1 has a distance of 5, and WAN2 has a distance of 10. Both are ON with the option "Retrieve default gateway from server" and OFF with "Override internal DNS."

- WAN1 and WAN2 are members of SD-Wan at the exact 0 cost.

- A static route 0.0.0.0/0.0.0.0 -> SD-wan interface has been added.

- There are multiple VLANs configured under Aggregate Link (downstream LAG to my Cisco switch), let's say vlan-10, vlan-20, vlan-30.

- Policies to access the Internet have been added for all Vlans above (source is vlan-x interface, and destination is SD-Wan).

** When there is just a default implicit SDWan rule with its Load-Balancing Algorithm, all nodes from above VLANs can access the Internet but are unstable due to sessions being switched between WAN1 and WAN2 continuously (look at the Forti View -> All Sessions and see the destination interface switching between sessions). To deal with this, I created an SDWan rule to manually select the wan member for each VLAN source, e.g., the source from vlan-10 will manually select WAN2 to forward the traffic.

After adding the SDWan rules for manually selecting members, I think the traffic will be routed as the definition, but it is not. It seems likely that the defined rule has not been hit, and the traffic still deals with the implicit SDWan rule. Monitor the route (with diag firewall proute list command); I see the hit_count=0 as always.

I don't know where the problem is or if there is a workaround to make the connection more stable.

It's weird to me, as I have a similar configuration on FG-100E that is running smoothly in another office.

I would appreciate it if someone could help. Please let me know if you need more information, and I will provide it.