Routing in Fortios 7

Tutek · ‎04-06-2023

Hi,

please explain me, after upgrade from 6.4.12 to 7.0.11 router add all my sd-wan zones to static route default route, now I have there virtual-wan-link and all my sdwan zones, before upgrade I had only there virtual-wan-link (my wan1 and wan2 interfaces) - I don't understand this change, I have static routes to my sd-wan networks so why now default route towards my sd-wan sites?

akristof · ‎04-06-2023

Hello,

It is because from 6.4 to 7.0 there is change how SDWAN zones work. So before, you had route via SDWAN only. In order to keep connectivity, FortiGate added basically all members as interface. So now you can adjust it, you can remove any zone/interface that does not have internet access, for example VPNs.

Adrian

Tutek · ‎04-07-2023

These sd-wan zones are my VPN sites, they use internet from HQ fortigate, but I still don't understand why default destination is to all my sd-wan zones. Where could I read about the changes that have occurred in sdwan in fortios 7?

akristof · ‎04-07-2023

On 6.4, you probably had default route via SD-WAN interface, right? Even if you had zones, in 6.4 it was only grouping for easier management. But for static routes you had to chose either SDWAN virtual interface or individual members.

From 7.0, you don't have SDWAN virtual interface, but you have zones. So the config converted it that instead single SDWAN virtual interface that was available in 6.4, in put every zone as destination to preserve connectivity.

Adrian

Tutek · ‎04-07-2023

I should connect to branch sdwan zone only for specific networks, not all 0.0.0.0/0 so I have for every branch network that is placed behind sdwan zones static routes configured like:

so I should connect to network 10.17.0.0/20 using sdwan zone let's name it "zone1" and I have something like this configured, I don't need destination 0.0.0.0/0 to be pushed using "zone1" - like it is now.

So this mean I should remove all specific destinations networks behind sdwan zones that I have configured, and should leave only this modified static route with 0.0.0.0/0 toward all sdwan zones?