FG60F with SD WAN Packet Loss Failures

[RolandBaumgaertner72]

Hi,

this FG60F with 7.4.5 (before 7.4.4 and same problems) has lots of problems with SD WAN.

Today I was there to ceck internet access and SD Wan config but I cant solve the problem. The SD WAN is strange, like at least 2-3 times a week and than for some hours one of the WANs has 30-80% package loss. Also than navigating behind the FG you notice the problem when you are using WAN x at this moment.

At the same time that the FG showed 70% package loss, I connected my laptop behind the router and checking with pings and internet speed test the line for >20min and NO problem at all. Again connecting to the FG I get package loss. I changed even the cable to be sure.

The SD Wan config is simple, one implicit rule sessions 50-50 and Performance SLA to ping Cloudflare 1.1.1.1 and 5-5-10-500-5-5 all activated.

What can be the reason of these package loss showing in the FG? Also I have fortiddns over WAN1 and when it shows package loss, I have problems connecting from outsider to the FG.

Thanks!

[RolandBaumgaertner72]

Hi,

this afternoon I will downgrade to 6.4.15. Before we had no problems with SD WAN and now we have problems x times per week.

We have one fiber access directly connected to the FW which worked fine for years and yersterday it went down. SD Wan is doing really strange things in this firewall and besides of havinf 2 x internet access the client gets offline 2 times a week.

From Fortinet Support I didnt hear back.

Thanks

[Marco_P]

Very strange...

we're using and setting up SD-WAN for many years, without these issues.  Currently we rollout 7.2.10 (latest major release), some in higher feature releases.  So, 7.2.x should work fine.

Are you sure the packet loss is not showing up when there is a lot of in/outbound traffic?  When you reach the limits of your ISP line this loss is normal.

Is the config of the Fortigate complex or is it a basic setup?  Can you do a factory reset and re-do the config?  Or if you have a spare FGT, connect that one to the ISP router and configure SDWAN only to do a health-check.