PROBLEM SDWAN

[EGP]

Good day,

I need an explanation or on the contrary a solution to the following problem

(Note: I am an amateur in this world and my English is not very good)

I have a machine with IP 192.168.1.10, I also have two ISP channels, these are located within the virtual-wan-link SDWAN zone and finally I have a rule for the Internet output of the mentioned machine

When reviewing the machine's traffic, it is evident that its output is being generated through my first Internet channel and in addition, packets are seen sent but not received by the destinations, that is, web pages. As a solution to this problem, an SDWAN rule was created so that all traffic to the Internet from said machine was carried out through my second Internet channel, which generated an effective response, that is, packets sent by the source (Machine) were shown as packets received by the destination (Web pages).

We consulted with the provider of our first internet channel to determine if the public IP was found on blacklists but it mentions that it was not. As a test, we put a direct device to the router of our first channel without any type of FortiGate in the middle and it is evident that there are packets sent as well as received

It is worth clarifying that this problem happens to us with specific devices, to which as a solution we have to send all their traffic through our second internet channel through SDWAN rules.

What can cause these types of events? Is the solution that is being implemented the best for this type of situation or how can we solve the issue?

[hgarara]

Hello @EGP ,

It would be worth specifying if those affected machines only face issue with specific websites or not. Besides that try running sniffer and debugs on FortiGate to verify that traffic is flowing through FortiGate expected. There could possibly other criteria to be considered such as ippools configured with those affected IPs with arp-reply enabled on them. VIPs configured with "any" interface. Consider configuring a separate policy for non-working host machine and try to lower the mss value on the policy. (https://community.fortinet.com/t5/FortiGate/Technical-Tip-Setting-TCP-MSS-value/ta-p/194518)

Thanks,

hgarara