Failover WAN Not Switching Back to Primary

[rfs3pa]

Hello,

I am trying to set up automatic failover wan using link-monitor and not SDWAN.  Before I even get as far setting up the link-monitor I am running into an issue.  My primary is wan2 and backup is wan1.  I have tried setting the static route for the backup to a higher priority and/or distance value.  When they are both connected it uses wan2 (what I want) then if I unplug wan2 it switches to wan1 (also good), but when plug wan2 back in it still uses wan1.  Shouldn't it switch right back to wan2?  I think I must be using the distance and or priority incorrectly.

wan1 and wan2 are in a zone and my internet access policy uses the zone.

 

[sjoshi]

Please refer below article and enable snat route change

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-SNAT-route-change-to-update-existing...

[AEK]

Hi RFS

Do you mean that the opened sessions still use WAN1 even if WAN2 is up again, and only new sessions use WAN2?

[rfs3pa]

Yes, I have a browser open to whatismyipaddres.com showing me the wan IP of wan 2.  If I disconnect wan2 and refresh I get the IP of wan1.  When I reconnect wan2 and refresh again I am still seeing the wan1 IP. 

I am trying to get to where once wan2 is reconnected I see the wan2 IP.

[Toshi_Esumi]

As in the KB @sjoshi shared, check the config:
config system global
  set snat-route-change enable
end

Toshi

[rfs3pa]

I set snat-route-change to enable, it was set to disable.  I am still having the problem.  Should I be using priority or distance to weight to routes?

[sjoshi]

share the below output:-

get router info routing-table all

get router info kernel

run this output before and after removing the cable

[Toshi_Esumi]

Either way should work. Share us the first part of "get router info routing-table all" that includes the default routes, when 1) both are up and working on wan2, and 2) wan2 was removed, then 3) after wan2 is restored.

Toshi

[rfs3pa]

Here it is.  Weird thing is [both up, working on wan2] and [wan2 restored] look the same, but when [wan2 restored] and I go whatismyipaddress.com I still see the wan1 IP.

both up, working on wan2
Routing table for VRF=0
S*      0.0.0.0/0 [5/0] via 192.168.10.1, wan2, [1/0]
                  [5/0] via 192.168.21.1, wan1, [1/0]
S       10.0.0.0/8 [10/0] is a summary, Null, [1/0]
S       10.212.134.0/24 [10/0] is directly connected, ssl.root, [1/0]
S       172.16.0.0/12 [10/0] is a summary, Null, [1/0]
S       192.168.0.0/16 [10/0] is a summary, Null, [1/0]
C       192.168.1.0/24 is directly connected, internal1
S       192.168.3.0/24 [10/0] is directly connected, Steve, [1/0]
C       192.168.10.0/24 is directly connected, wan2
C       192.168.21.0/24 is directly connected, wan1

wan2 removed
Routing table for VRF=0
S*      0.0.0.0/0 [5/0] via 192.168.21.1, wan1, [1/0]
S       10.0.0.0/8 [10/0] is a summary, Null, [1/0]
S       10.212.134.0/24 [10/0] is directly connected, ssl.root, [1/0]
S       172.16.0.0/12 [10/0] is a summary, Null, [1/0]
S       192.168.0.0/16 [10/0] is a summary, Null, [1/0]
C       192.168.1.0/24 is directly connected, internal1
S       192.168.3.0/24 [10/0] is directly connected, Steve, [1/0]
C       192.168.21.0/24 is directly connected, wan1

wan2 restored
Routing table for VRF=0
S*      0.0.0.0/0 [5/0] via 192.168.10.1, wan2, [1/0]
                  [5/0] via 192.168.21.1, wan1, [1/0]
S       10.0.0.0/8 [10/0] is a summary, Null, [1/0]
S       10.212.134.0/24 [10/0] is directly connected, ssl.root, [1/0]
S       172.16.0.0/12 [10/0] is a summary, Null, [1/0]
S       192.168.0.0/16 [10/0] is a summary, Null, [1/0]
C       192.168.1.0/24 is directly connected, internal1
S       192.168.3.0/24 [10/0] is directly connected, Steve, [1/0]
C       192.168.10.0/24 is directly connected, wan2
C       192.168.21.0/24 is directly connected, wan1

[rfs3pa]

Here it is.  Weird thing is [both up, working on wan2] and [wan2 restored] look the same, but when [wan2 restored] and I go whatismyipaddress.com I still see the wan1 IP.

both up, working on wan2
Routing table for VRF=0
S*      0.0.0.0/0 [5/0] via 192.168.10.1, wan2, [1/0]
                  [5/0] via 192.168.21.1, wan1, [1/0]
S       10.0.0.0/8 [10/0] is a summary, Null, [1/0]
S       10.212.134.0/24 [10/0] is directly connected, ssl.root, [1/0]
S       172.16.0.0/12 [10/0] is a summary, Null, [1/0]
S       192.168.0.0/16 [10/0] is a summary, Null, [1/0]
C       192.168.1.0/24 is directly connected, internal1
S       192.168.3.0/24 [10/0] is directly connected, Steve, [1/0]
C       192.168.10.0/24 is directly connected, wan2
C       192.168.21.0/24 is directly connected, wan1

wan2 removed
Routing table for VRF=0
S*      0.0.0.0/0 [5/0] via 192.168.21.1, wan1, [1/0]
S       10.0.0.0/8 [10/0] is a summary, Null, [1/0]
S       10.212.134.0/24 [10/0] is directly connected, ssl.root, [1/0]
S       172.16.0.0/12 [10/0] is a summary, Null, [1/0]
S       192.168.0.0/16 [10/0] is a summary, Null, [1/0]
C       192.168.1.0/24 is directly connected, internal1
S       192.168.3.0/24 [10/0] is directly connected, Steve, [1/0]
C       192.168.21.0/24 is directly connected, wan1

wan2 restored
Routing table for VRF=0
S*      0.0.0.0/0 [5/0] via 192.168.10.1, wan2, [1/0]
                  [5/0] via 192.168.21.1, wan1, [1/0]
S       10.0.0.0/8 [10/0] is a summary, Null, [1/0]
S       10.212.134.0/24 [10/0] is directly connected, ssl.root, [1/0]
S       172.16.0.0/12 [10/0] is a summary, Null, [1/0]
S       192.168.0.0/16 [10/0] is a summary, Null, [1/0]
C       192.168.1.0/24 is directly connected, internal1
S       192.168.3.0/24 [10/0] is directly connected, Steve, [1/0]
C       192.168.10.0/24 is directly connected, wan2
C       192.168.21.0/24 is directly connected, wan1