Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
nvdokh
New Contributor II

Incoming connection only accepted on the highest priority WAN

I have 2 WAN connections. Both with distance of 10 but with different priorities. However, after upgrading to 7.4.2, only the “active” WAN with highest priority (lower number) accepts incoming connections (admin, VPN, etc.)

 

Any idea how to fix this or what has changed from 7.4.0 to 7.4.2?

12 REPLIES 12
rosatechnocrat
Contributor II

Dear nvdokh,

 

This is how it works.  If we have multiple routes with same distance but configured different priorities then route with lower priority will be used for forwarding the data. 

 

So you can make the same priority value for all routes if you want ECMP to happen. 

 

You can refer below link to understand different scenarios. 

 

https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/25967/equal-cost-multi-path#Example

Rosa Technocrat -- Also on YouTube---Please do Subscribe
Rosa Technocrat -- Also on YouTube---Please do Subscribe
AEK
Honored Contributor II

Can you run this command while connecting to a non-working WAN interface?

diag snif packet any 'host x.x.x.x' 4

Where x.x.x.x is the client's public IP.

AEK
AEK
nvdokh
New Contributor II

62.145784 wan2 in x.x.x.x.1419 -> 10.100.0.2.1443: syn 2400571139
62.145976 wan1 out 10.100.0.2.1443 -> x.x.x.x.1419: syn 2733505284 ack 2400571140

hbac
Staff
Staff

Hi @nvdokh,

 

Are you using SDWAN. Please provide the output of this command "get router info routing-table database". 

 

Regards, 

nvdokh
New Contributor II

Routing table for VRF=0
S *> 0.0.0.0/0 [10/0] via a.a.a.1, wan1, [11/0]
   *> [10/0] via 10.100.0.1, wan2, [12/0]
   *> [10/0] via 1-Dialup tunnel 10.0.0.1, [102/0]
   *> [10/0] via 2-Dialup tunnel x.x.x.x, [104/0]
S 0.0.0.0/0 [15/0] via 2-Dialup tunnel y.y.y.y, [1/0]
C *> 10.0.0.0/24 is directly connected, internal
C *> 10.0.250.0/24 is directly connected, Guest
C *> 10.100.0.0/24 is directly connected, wan2
C *> a.a.a.0/24 is directly connected, wan1

hbac

@nvdokh,

 

Are you using SDWAN? If yes, it matches a bug ID 961796https://docs.fortinet.com/document/fortigate/7.4.3/fortios-release-notes/236526/known-issues

 

Regards, 

nvdokh
New Contributor II

I’m not using SDWAN. Also, I have the same issue connecting to SSL VPN on Wan2. 

AEK
Honored Contributor II

You see the traffic is coming from wan2 but is returning via wan1. This will not work.

If you can't make both wan interfaces with same priority then as suggested by @rosatechnocrat I'd suggest to use policy routing to force the traffic with source IP 10.100.0.2 to return via wan2.

I actually don't know if this is the best solution but it should work.

AEK
AEK
nvdokh
New Contributor II

It didn't solve the issue:

 

config router policy

   edit 1

      set src "10.100.0.2/255.255.255.0"

      set dstaddr "all"

      set output-device "want2"

   next

end

Labels
Top Kudoed Authors