- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Incoming connection only accepted on the highest priority WAN
I have 2 WAN connections. Both with distance of 10 but with different priorities. However, after upgrading to 7.4.2, only the “active” WAN with highest priority (lower number) accepts incoming connections (admin, VPN, etc.)
Any idea how to fix this or what has changed from 7.4.0 to 7.4.2?
- Labels:
-
FortiGate
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Dear nvdokh,
This is how it works. If we have multiple routes with same distance but configured different priorities then route with lower priority will be used for forwarding the data.
So you can make the same priority value for all routes if you want ECMP to happen.
You can refer below link to understand different scenarios.
https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/25967/equal-cost-multi-path#Example
Also on YouTube---
Please do Subscribe
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you run this command while connecting to a non-working WAN interface?
diag snif packet any 'host x.x.x.x' 4
Where x.x.x.x is the client's public IP.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
62.145784 wan2 in x.x.x.x.1419 -> 10.100.0.2.1443: syn 2400571139
62.145976 wan1 out 10.100.0.2.1443 -> x.x.x.x.1419: syn 2733505284 ack 2400571140
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @nvdokh,
Are you using SDWAN. Please provide the output of this command "get router info routing-table database".
Regards,
Created on 02-18-2024 07:23 PM Edited on 02-18-2024 07:47 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Routing table for VRF=0
S *> 0.0.0.0/0 [10/0] via a.a.a.1, wan1, [11/0]
*> [10/0] via 10.100.0.1, wan2, [12/0]
*> [10/0] via 1-Dialup tunnel 10.0.0.1, [102/0]
*> [10/0] via 2-Dialup tunnel x.x.x.x, [104/0]
S 0.0.0.0/0 [15/0] via 2-Dialup tunnel y.y.y.y, [1/0]
C *> 10.0.0.0/24 is directly connected, internal
C *> 10.0.250.0/24 is directly connected, Guest
C *> 10.100.0.0/24 is directly connected, wan2
C *> a.a.a.0/24 is directly connected, wan1
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you using SDWAN? If yes, it matches a bug ID 961796. https://docs.fortinet.com/document/fortigate/7.4.3/fortios-release-notes/236526/known-issues
Regards,
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I’m not using SDWAN. Also, I have the same issue connecting to SSL VPN on Wan2.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You see the traffic is coming from wan2 but is returning via wan1. This will not work.
If you can't make both wan interfaces with same priority then as suggested by @rosatechnocrat I'd suggest to use policy routing to force the traffic with source IP 10.100.0.2 to return via wan2.
I actually don't know if this is the best solution but it should work.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It didn't solve the issue:
config router policy
edit 1
set src "10.100.0.2/255.255.255.0"
set dstaddr "all"
set output-device "want2"
next
end