Incoming connection only accepted on the highest priority WAN

[nvdokh]

I have 2 WAN connections. Both with distance of 10 but with different priorities. However, after upgrading to 7.4.2, only the “active” WAN with highest priority (lower number) accepts incoming connections (admin, VPN, etc.)

Any idea how to fix this or what has changed from 7.4.0 to 7.4.2?

[rosatechnocrat]

Dear nvdokh,

This is how it works.  If we have multiple routes with same distance but configured different priorities then route with lower priority will be used for forwarding the data. 

So you can make the same priority value for all routes if you want ECMP to happen. 

You can refer below link to understand different scenarios. 

https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/25967/equal-cost-multi-path#Example

[AEK]

Can you run this command while connecting to a non-working WAN interface?

diag snif packet any 'host x.x.x.x' 4

Where x.x.x.x is the client's public IP.

[nvdokh]

62.145784 wan2 in x.x.x.x.1419 -> 10.100.0.2.1443: syn 2400571139
62.145976 wan1 out 10.100.0.2.1443 -> x.x.x.x.1419: syn 2733505284 ack 2400571140

[hbac]

Hi @nvdokh,

Are you using SDWAN. Please provide the output of this command "get router info routing-table database". 

Regards, 

[nvdokh]

Routing table for VRF=0
S *> 0.0.0.0/0 [10/0] via a.a.a.1, wan1, [11/0]
   *> [10/0] via 10.100.0.1, wan2, [12/0]
   *> [10/0] via 1-Dialup tunnel 10.0.0.1, [102/0]
   *> [10/0] via 2-Dialup tunnel x.x.x.x, [104/0]
S 0.0.0.0/0 [15/0] via 2-Dialup tunnel y.y.y.y, [1/0]
C *> 10.0.0.0/24 is directly connected, internal
C *> 10.0.250.0/24 is directly connected, Guest
C *> 10.100.0.0/24 is directly connected, wan2
C *> a.a.a.0/24 is directly connected, wan1

[hbac]

@nvdokh,

Are you using SDWAN? If yes, it matches a bug ID 961796. https://docs.fortinet.com/document/fortigate/7.4.3/fortios-release-notes/236526/known-issues

Regards, 

[nvdokh]

I’m not using SDWAN. Also, I have the same issue connecting to SSL VPN on Wan2. 

[AEK]

You see the traffic is coming from wan2 but is returning via wan1. This will not work.

If you can't make both wan interfaces with same priority then as suggested by @rosatechnocrat I'd suggest to use policy routing to force the traffic with source IP 10.100.0.2 to return via wan2.

I actually don't know if this is the best solution but it should work.

[nvdokh]

It didn't solve the issue:

config router policy

   edit 1

      set src "10.100.0.2/255.255.255.0"

      set dstaddr "all"

      set output-device "want2"

   next

end