Hi, guys,
I have a network infrastructure:
1. Three sites: SiteA, SiteB and SiteC;
2. The Forti400E pair sits between SiteA and SiteC;
3. The Forti400E pair has individual static route table for SiteA and SiteC:
4. The Forti400E pair has a SDWAN ( Link01 (port08) and Link02 (port9) ) to SiteC.
5. The SDWAN is using Link01(port8) for primary link to access SiteC ( SDWAN is configured for this ), but the link02 (port9) has better SLA
My problem ( port9 is link02, in my test):
==========================
1. When I just opened the CLI mode, without any specified source interface :
1.1 Pingtest to siteC -- OK!!
1.2 traceroute is OK
2. When I specified an source interface,
2.1 Pintest to siteC failed
2.2 traceroute failed
3. What reason the SDWAN used link02/port9 for accessing SiteC ( not useing link01/port8 ), while specifying the source interface?
Noted: 10.10.32.65 is GW of the link01; 10.10.32.91 is GW of the link02
Test result refers to the attached captured.
Any idea or advice.
Thanks a lot
Benson LEI
Hi, Guys,
When I captured the route..something interesting:
================================
Forti400E_2 # diag ip rtcache list
No specified source interface: ===============================
family=02 tab=254 vrf=0 vf=0 type=01 tos=0 flag=00000200 0.0.0.0@0->10.131.1.23@16(port8) gwy=10.10.32.65 prefsrc=10.10.32.70 ci: ref=0 lastused=0 expire=0 err=00000000 used=0 br=0 pmtu=1500
With specified source interface : =================================
family=02 tab=254 vrf=0 vf=0 type=01 tos=0 flag=00000200 10.16.1.254@0->10.131.1.23@17(port9) gwy=10.10.32.91 prefsrc=0.0.0.0 ci: ref=0 lastused=0 expire=0 err=00000000 used=0 br=0 pmtu=1500
My finding:
=======
1. When no specified source interface....route path is using SDWAN for decision making
2. When specified source interface ... route path is using static route for decision making
My guess is correct, thx ?
Thanks a lot
Unfortunately you did not wirte the ip config of the link01 and link02 interface.
Do you have corresponding policies for both links?
Is link02 in Site C Subnet?
--
"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
I am fairly new to Fortigate products but I have been making a lot of support calls on issues very similar to this. Fortigates have no one way of handling traffic generated on the firewall. If you have a fabric setup with SDWan I am sure you would have gone through a few of them. Some traffic seems to not be able to use SD-WAN at all and requires a manual static route while others have a setting to tell them to use the SD-WAN rules.
In this case ( I have not tried this yet myself) have you tried the "execute ping-options use-sdwan" command in conjunction with your specified interface?
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1737 | |
1107 | |
752 | |
447 | |
240 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.