Fortiddns On 2 WAN

[Andrew_C]

Hi Everyone,

I've configured 2 fortiddns on 2 wan in 60F (use SDWAN for failover) but I can't access FW using either one. I use the same configuration in 61E (also use SDWAN for failover) both can work. Is something missed in the configuration ?

Thanks for help.

[Toshi_Esumi]

Sounds like your both DDNSes are working fine. You are accessing those from outside over the internet, right? What kind of default routes do you have in your routing table?
Go to CLI, then get output of "get router info routing-t all". At the top, you should see those default routes like below:

fg40f-utm (root) # get router info routing-t all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
<snip>

Routing table for VRF=0
S* 0.0.0.0/0 [1/0] via x.x.x.x, ppp3, [1/20]
                    [1/0] via y.y.y.y, a, [1/1]

 Toshi

[Andrew_C]

Hi Toshi, I see as below. Because I setup sd-wan for internet failover, is it the problem ?

Routing table for VRF=0
S* 0.0.0.0/0 [1/0] via x.x.x.x, wan2, [1/0]
                    [1/0] via x.x.x.x, wan1, [1/0]
C x.x.x.x/24 is directly connected, wan2
C x.x.x.x/24 is directly connected, wan1

[Toshi_Esumi]

SD-WAN should be fine while mine has it as well and confirmed it working by temporarily enabling admin access on both interfaces, which is regularly blocked. As you can see in my default routes, I'm using "weight" (20 vs. 1) to fail-over from 'ppp3' to 'a'.

Anyway, you have two different IPs although you represended them both by x.x.x.x, right? But the subnet /24 is a little bit unusual if they're from your ISPs and public IPs. Or are they from ISP's routers and those are private subnets?

Toshi

[Andrew_C]

Hi Toshi, both are public ip come from 2 isp, set the wan1 or wan2 to weight 20 and still not work. I really don't know what's missing in the configuration.

[Toshi_Esumi]

Public IPs with /24 mask from two different ISPs? Are you sure?

Toshi

[Andrew_C]

Hi Toshi, yes they come with 2 isp with /24 mask. I have another isp it also with /24 mask.

w.w.w.w/24

x.x.x.x/24

y.y.y.y/24

[Toshi_Esumi]

Remote access traffic is not too easy to debug without actually getting in your FGT unlike pass-through traffic, which you can do flow debugging. I recommend you open a ticket at TAC to get your FGT looked at by a TAC person.

Toshi

[gloston2]

Have you actually considered setting up sdwan, both interfaces in the same zone, and then just use sdwan rules to steer traffic to wan1 99.9% of the time, and only use lte when wan1 actually fails performance monitors? Just be really loose with your what fails — if your normal ping to 8.8.8.9 for example is 10ms, set fail at 300ms or 80%+ packet loss. It’ll take 10 seconds to fail over that way, but it’s better than running your lte bill through the roof https://omegle.onl/ .