I need help with routing on Fortigate.

[renanrdrigues]

Dear all,
I have two internet links.
One of the links connects to a VPN with a partner and works perfectly, but on the second internet link, the VPN is intermittent, sometimes working and sometimes not...

WAN1 - 200.40.221.10 (VPN OK)
WAN2 - 187.23.200.38 (VPN Intermittent)

What I noticed:
When we are closing the VPN with WAN2 and I run the following traceroute:

exec traceroute-options source 187.23.200.38
exec traceroute 200.24.197.4(PARTNER)

The first hop is WAN1 and not WAN2, as if the routing were always sending through WAN1.

I have a route: 0.0.0.0/0 -> virtual-wan-link

Even though I am forcing SDWAN to use WAN2, the traceroute continues to go through WAN1.

SDWAN Rules:
VPN_PARTNER
SOURCE: PARTNER-NETWORK
DESTINATION: SERVERS
MEMBERS: WAN2

What could be happening?

[Toshi_Esumi]

Unless both are NOT DHCP/PPPoE circuits (you sounded like), you have to configure separate GWs in two static default routes. Even DHCP/PPPoE where you don't need to configure static default routes, when you check your routing table, you should see two default routes. Below is mine with three default routes:

fg40f-utm (root) # get router info routing-t all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
V - BGP VPNv4
* - candidate default

Routing table for VRF=0
S* 0.0.0.0/0 [1/0] via x.x.x.x, a, [1/254]
                       [1/0] via SFOviaCentu tunnel x.x.x.x, [1/253]
                       [1/0] via x.x.x.x, ppp3, [100/255]

<snip>

What do you see in your routing table? The first one is DHCP, the second is static (from "0/0 to virtual-wan-link"), and the last is PPPoE.


Toshi

 

[renanrdrigues]

It's not DHCP, the two links are dedicated:

get router info routing-t all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
V - BGP VPNv4
* - candidate default

Routing table for VRF=0
S* 0.0.0.0/0         [1/0] via 187.23.200.39, VLAN200, [1/0]
                               [1/0] via 200.40.221.11, VLAN201, [1/0]
                             

[Toshi_Esumi]

Looks fine to me, except those .38 and .10 are GW IPs in your static default routes, not the IPs on the FGT's interfaces unless you modified the output of the command.

Toshi 

[Toshi_Esumi]

And those are on VLAN200 and VLAN201, not directly on wan1 and wan2.

[renanrdrigues]

It is an aggregate, it is in a core switch links.

[renanrdrigues]

I've corrected it, I put it wrong, the gw are actually .38 and .10 and the interfaces are .39 and .11

[Toshi_Esumi]

What do you mean by "aggregate"? If they're VLANs, those are VLANs on top of physical interfaces like wan1 or LAG. And none of those physical interfaces would show in your SD-WAN member config, but VLAN interfaces should be the members.

So you're saying VPN from/to (you didn't say either site-to-site or remote access VPN) VLAN201 doesn't work? Is the IP consistently pingable from outside/over the internet? Or depending on the destinations?

Toshi 

[renanrdrigues]

Yes, a LAG.
The links are connected to the switch and pass through the trunk to the Fortigate.

I put WAN to make it easier to understand.

VPN with vlan200 (187.23.200.39) is intermittent, as if it were asymmetrical, sometimes it works and sometimes it doesn't.

And when I do a tracert from my Fortigate to my partner's Fortigate, the result is that it goes out through the other link, vlan201 (200.40.221.11).

[Toshi_Esumi]

So those are site-to-site VPNs then. At the partner side do they have static public IPs on the interface as well? If so, you can put a /32 static route to either vlan200 or vlan201 so that it won't flip-flop.
Also in the IPsec phase1-interface config, you needed to specify the outgoing interface either vlan200 or vlan201. 

Toshi