Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
BensonLEI
Contributor

Route issue or SDWAN issue ?

Hi, guys,

 

I have a network infrastructure:

1. Three sites: SiteA, SiteB and SiteC;

2. The Forti400E pair sits between SiteA and SiteC;

3. The Forti400E pair has individual static route table for SiteA and SiteC:

4. The Forti400E pair has a SDWAN ( Link01 (port08) and Link02 (port9) ) to SiteC.

 

5. The SDWAN is using Link01(port8) for primary link to access SiteC ( SDWAN is configured for this ), but the link02 (port9) has better SLA

 

 

My problem ( port9 is link02, in my test):

==========================

 1. When I just opened the CLI mode, without any specified source interface :    

    1.1  Pingtest to siteC     -- OK!!

    1.2   traceroute is OK    

 

2. When I specified an source interface,

    2.1  Pintest to siteC failed

    2.2  traceroute failed

 

3. What reason the SDWAN used link02/port9 for accessing SiteC ( not useing link01/port8 ), while specifying the source interface?

 

 

Noted: 10.10.32.65 is GW of the link01; 10.10.32.91 is GW of the link02

 

 

 

Test result refers to the attached captured.

 

Any idea or advice.

 

Thanks a lot

Benson LEI

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

3 REPLIES 3
BensonLEI
Contributor

Hi, Guys,

 

When I captured the route..something interesting:

================================

 

Forti400E_2 # diag ip rtcache list

No specified source interface: ===============================

family=02 tab=254 vrf=0 vf=0 type=01 tos=0 flag=00000200 0.0.0.0@0->10.131.1.23@16(port8) gwy=10.10.32.65 prefsrc=10.10.32.70 ci: ref=0 lastused=0 expire=0 err=00000000 used=0 br=0 pmtu=1500

 

With specified source interface : =================================

family=02 tab=254 vrf=0 vf=0 type=01 tos=0 flag=00000200 10.16.1.254@0->10.131.1.23@17(port9) gwy=10.10.32.91 prefsrc=0.0.0.0 ci: ref=0 lastused=0 expire=0 err=00000000 used=0 br=0 pmtu=1500

 

 

 

 

My finding:

=======

1. When no specified source interface....route path is using SDWAN for decision making

2. When specified source interface ... route path is using static route for decision making

 

My guess is correct, thx ?

 

 

Thanks a lot

 

 

 

 

sw2090

Unfortunately you did not wirte the ip config of the link01 and link02 interface.

Do you have corresponding policies for both links?

Is link02 in Site C Subnet?

 

 

-- 

"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

-- "It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
jimthecanadian
New Contributor

I am fairly new to Fortigate products but I have been making a lot of support calls on issues very similar to this.   Fortigates have no one way of handling traffic generated on the firewall.   If you have a fabric setup with SDWan I am sure you would have gone through a few of them.   Some traffic seems to not be able to use SD-WAN at all and requires a manual static route while others have a setting to tell them to use the SD-WAN rules.

 

In this case ( I have not tried this yet myself) have you tried the "execute ping-options use-sdwan" command in conjunction with your specified interface?

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors