Fortigate 1100E - SDWAN and policy route issue

[pacionet]

Hi,

on Fortigate 1100e (7.4.9) we set up an SDWAN like this

We would OpenNMS pinging a public ip (8.8.8.8) through the line of ROUTER1 and another public IP (8.8.4.4) through the line of ROUTER2. So we set up these policy routes:

SOURCE         DESTINATION      GATEWAY

OPENNMS      8.8.8.8                  ROUTER1

OPENNMS      8.8.4.4                  ROUTER2

In static routes we have:

0.0.0.0/0      SDWAN

In SDWAN policy we have the default (selected members by source IP)

When both interfaces WAN1 and WAN2 are up all works, but:

• If we disable WAN2 interface both ping works
• If we disable WAN1 interface both ping not works

when both interface are up, traceroute show that the routes are correct  (the ping towards 8.8.8.8 choose WAN1 , while the pings toward 8.8.4.4 choose WAN2)

Any ideas?

Thanks

[funkylicious]

hi,

do you do NAT on the FGT or on the routers ?

diagnose firewall proute list - shows correctly what you have configured / can you post it ?

[pacionet]

NAT is on the FGT

Policy routes (gateway are masked):

id=1(0x01) dscp_tag=0xfc 0xfc flags=0x0 tos=0x00 tos_mask=0x00 protocol=0 port=src(0->0):dst(0->0) iif=16(port4)
path(1): oif=66(WAN1) gwy=X.Y.W.Z path_last_used=2025-12-05 09:22:33
source wildcard(1): 10.93.233.229/255.255.255.255
destination wildcard(1): 8.8.8.8/255.255.255.255
hit_count=14065 rule_last_used=2025-12-05 09:22:33

id=2(0x02) dscp_tag=0xfc 0xfc flags=0x0 tos=0x00 tos_mask=0x00 protocol=0 port=src(0->0):dst(0->0) iif=16(port4)
path(1): oif=87(WAN2) gwy=A.B.C.D path_last_used=2025-12-05 09:21:54
source wildcard(1): 10.93.233.229/255.255.255.255
destination wildcard(1): 8.8.4.4/255.255.255.255
hit_count=3925 rule_last_used=2025-12-05 09:21:54

Both policy work when both interface are up, but If we deactivated WAN1, both pings not work

[funkylicious]

do you have auxiliary-session enabled? if not, try enabling it and see if it solves the issue.

config system settings
    set auxiliary-session enable
end 

[pacionet]

I tried the setting you suggested

set auxiliary-session enable

 but it doesn't work.

If we disabled one interface of the SDWAN, all others client using SDWAN works, except the ping from OpenNMS.

Maybe the problem is having policy routes AND SDWAN together?

[funkylicious]

policy routes take precedence over SD-WAN rules.

L.E. i would disable the policy routes and create sd-wan rules for NMS with the selection of manual outgoing interfaces and do another test like that.

[pacionet]

Ok but we have only the implicit SDWAN rule and 2 policy routes

SOURCE         DESTINATION      GATEWAY

OPENNMS      8.8.8.8                  ROUTER1

OPENNMS      8.8.4.4                  ROUTER2

The policy routes seems working when both interface are active, but if we disable WAN1, the policy routes toward "ROUTER2" not working (the policy is matched but we see 0 bytes of response in firewall logs)

---

@funkylicious wrote:

policy routes take precedence over SD-WAN rules.

L.E. i would disable the policy routes and create sd-wan rules for NMS with the selection of manual outgoing interfaces and do another test like that.

---

Yes, we did it exactly: tried to delete policy routes and set 2 SDWAN Rules like these:

SOURCE: OpenNMS Destination: 8.8.8.8 Criteria: Forced member WAN1

SOURCE: OpenNMS Destination: 8.8.4.4 Criteria: Forced member WAN2

but we still got the same problem ( with set auxiliary session enable and disable)

[pacionet · Accepted solution]

Sorry 

I found the problem.

I used a wrong NAT on firewall Policy

We need 2 policy:

OpenNMS -> 8.8.8.8 -> NAT WAN1

OpenNMS -> 8.8.4.4 -> NAT WAN2

Thanks !