Route issue or SDWAN issue ?

[BensonLEI]

Hi, guys,

I have a network infrastructure:

1. Three sites: SiteA, SiteB and SiteC;

2. The Forti400E pair sits between SiteA and SiteC;

3. The Forti400E pair has individual static route table for SiteA and SiteC:

4. The Forti400E pair has a SDWAN ( Link01 (port08) and Link02 (port9) ) to SiteC.

5. The SDWAN is using Link01(port8) for primary link to access SiteC ( SDWAN is configured for this ), but the link02 (port9) has better SLA

My problem ( port9 is link02, in my test):

==========================

 1. When I just opened the CLI mode, without any specified source interface :    

    1.1  Pingtest to siteC     -- OK!!

    1.2   traceroute is OK    

2. When I specified an source interface,

    2.1  Pintest to siteC failed

    2.2  traceroute failed

3. What reason the SDWAN used link02/port9 for accessing SiteC ( not useing link01/port8 ), while specifying the source interface?

Noted: 10.10.32.65 is GW of the link01; 10.10.32.91 is GW of the link02

Test result refers to the attached captured.

Any idea or advice.

Thanks a lot

Benson LEI

[BensonLEI]

Hi, Guys,

When I captured the route..something interesting:

================================

Forti400E_2 # diag ip rtcache list

No specified source interface: ===============================

family=02 tab=254 vrf=0 vf=0 type=01 tos=0 flag=00000200 0.0.0.0@0->10.131.1.23@16(port8) gwy=10.10.32.65 prefsrc=10.10.32.70 ci: ref=0 lastused=0 expire=0 err=00000000 used=0 br=0 pmtu=1500

With specified source interface : =================================

family=02 tab=254 vrf=0 vf=0 type=01 tos=0 flag=00000200 10.16.1.254@0->10.131.1.23@17(port9) gwy=10.10.32.91 prefsrc=0.0.0.0 ci: ref=0 lastused=0 expire=0 err=00000000 used=0 br=0 pmtu=1500

My finding:

=======

1. When no specified source interface....route path is using SDWAN for decision making

2. When specified source interface ... route path is using static route for decision making

My guess is correct, thx ?

Thanks a lot

[sw2090]

Unfortunately you did not wirte the ip config of the link01 and link02 interface.

Do you have corresponding policies for both links?

Is link02 in Site C Subnet?

[jimthecanadian]

I am fairly new to Fortigate products but I have been making a lot of support calls on issues very similar to this.   Fortigates have no one way of handling traffic generated on the firewall.   If you have a fabric setup with SDWan I am sure you would have gone through a few of them.   Some traffic seems to not be able to use SD-WAN at all and requires a manual static route while others have a setting to tell them to use the SD-WAN rules.

In this case ( I have not tried this yet myself) have you tried the "execute ping-options use-sdwan" command in conjunction with your specified interface?