Routing Issue

[grecko]

I'm having an issue where our firewall is routing some internal ip addresses out the external public interface instead of across the VPN connection as setup on static routes.  Its really weird because its not doing it to all the internal ip connections.  Any ideas what would cause this???

[Shawn_W]

I have seen this issue with incorrect NAT.  Just my 2 cents.

[Iescudero]

HI!

Can you post this config?

routing table:

in CLI: get router info routing-table all

Policy Routes:

config router policy

show

end

Firewall Policys:

config firewall policy

show

Bye!

[grecko]

It was a NAT issue.  I turned off NAT for external ping and it appears to be working now.  We will see if this pops back up over time.

[Christopher_McMullan]

If tunnels with specific routes bound to the local (tunnel) interface go down, often the default route takes over, which would be your WAN port. Once the tunnel comes back up, the existing sessions using WAN1 will not switch back over.

It may help to create a deny policy above the rest that goes something like this:

config firewall address

edit "10_range"

set subnet 10.0.0.0 255.0.0.0

next

edit "172_range"

set subnet 172.16.0.0 255.240.0.0

next

edit "192_range"

set subnet 192.168.0.0 255.255.0.0

end

config firewall addrgrp

edit "Private"

set member "10_range" "172_range" "192_range"

end

config firewall policy

edit 0

set srcintf internal

set dstintf wan1

set srcaddr all

set dstaddr "Private"

set schedule always

set service ALL

set action deny

next

show <--find the policy you just created

move x before y <--the new policy, 'x', should go before your highest policy 'y'. This will kill sessions trying to use the WAN interface while the tunnel is down until the VPN can be restored

end