OVERLAY NETWORK CAN NOT BE REACHED SD-WAN BGP

[aidnet]

Hello team 

We have configured the SD-WAN network, now the FGT 70 is at brach and FGT 200F at HQ, now all Underlay Network is reached through ISP means 70F at branch can ping 200F at HQ ,but LAN network is not reached trough Overlay 

what is the issue?

[saleha]

Hi Aidnet,

Thank you for reaching out. This sounds like a traffic issue. I assume the overlay interfaces are ipsec tunnels and phase1 and 2 on the tunnel is up. I assume also that phase 2 selectors have correct subnets on both ends if applicable. You will need to check routing first making sure the advertised and received subnets are showing properly in the routing table:

# get router info routing-table bgp

# get router info routing-table all

# get router info routing-table details x.x.x.x ---------- the subnet you are looking up

# get router info bgp summary -------- gives you a list of all bgp neighbors and their ip

# get router info bgp neighbors y.y.y.y advertised-routes --------- this should be the neighbor ip

# get router info bgp neighbors y.y.y.y received-routes

- If all is good on routing side then you will have to check if sdwan rules are setup correctly and the correct overlay interface is selected. You will also need to check if performance sla is used that the interfaces are showing up. This can be done from gui: "Network>SDWAN"

- If you are using any options to prefer a specific route using SDWAN that is not listed on the advertised or received routes on bgp by changing cost for example for the overlay interface while using lowest-cost strategy or using priority with manual strategy then try to match your config to the bgp active routes.

- If routing and sdwan is good then check firewall policies and make sure interfaces, source and destination and services, etc are all correct.

I recommend if the fortigates have support contract to open a support ticket as this is a complicated subject specially with the involvement of bgp routing and sdwan.

Thank you,

saleha

[aidnet]

as of now HQ FW 200F it can see Branch 70F LAN Network, and it can ping the LAN user IP, But The 70F Branch FW it can't see the HQ 200F LAN Networks... so LAN to LAN can't reach each other

[amrit]

1. Verify if the BGP neighbours are up

get router info bgp summary 

2.Check if there is valid route to the bgp destination via the overlay 

get router info routing-table details <destination ip>

Also check if the route is received via bgp peer

get router info bgp neighbor <ip address of the neighbor> received-routes

3. Check if there is a firewall policy to allow this traffic 

4. Check if SDWAN rules are in the correct order and if the correct outgoing interface is selected. Also, if you are using performance SLAs make sure the SLAs are up

5.Run following debugs and upload 

di de flow filter <dst ip>

di de flow filter proto 1

di de flow show function-name en

di de flow trace start 100

di de en

On CLI2

di sniffer packet any 'host <dest ip> and icmp' 4 0 l 

Ping the destination

[aidnet]

as of now HQ FW 200F it can see Branch 70F LAN Network, and it can ping the LAN user IP, But The 70F Branch FW it can't see the HQ 200F LAN Networks... so LAN to LAN can't reach each other.

[aidnet]

The underlay network is ok, HQ and Branch FW can ping each other.

But on the Branch FW  you cannot see the LAN network from the Branch if you run get router info routing-table all.

but in the HQ if you run get router info routing-table all, you can see the LAN network.

[amrit]

Please provide the following debugs from the 70F

get router info bgp summary   -- mention the peer bgp ip 

get router info routing-table details <destination lan ip>

CLI1

di de flow filter <dst ip>

di de flow filter proto 1

di de flow show function-name en

di de flow trace start 100

di de en

CLI2:di sniffer packet any 'host <dest ip> and icmp' 4 0 l 

Ping the destination

Also check the firewall rules and sdwan rules

Without checking the above debugs, it is not possible to find the root cause

[aidnet]

the underlay network is ok, HQ and Branch FW can ping each other.

But on the Branch FW  you cannot see the LAN network from the Branch if you run get router info routing-table all.

but in the HQ if you run get router info routing-table all, you can see the LAN network.

[aidnet · Accepted solution]

Hello Team we found the Solution ,

The solution is we were not advertise the LAN network that is why the branch did not see the network so we use Default route originate command to advertise the LAN network and it works