SD WAN Fail over testing need to restart ping command (Mac)

[jacky0394]

Hi

I am following this page for SD WAN setup for link failover over: https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/990932/redundant-internet-with-sd-wan

I managed to get it some how working, however, it is a very strange behaviour

1. ping 8.8.8.8 on my Mac, which is connected to Fortigate via physical wire

2. remove WAN 1

3. the ping command in (1) report timeout, for more than 20 sec (which the default SLA check is 5 failed attempts for 1s interval)

4. I stopped the ping command, and restart ping again, now ping succeed.

So, every-time in order to fail over, I need to kill the ping session and restart, 

are there any reason for this?

[lobstercreed]

Yeah, if NAT is involved, existing sessions do not fail over.  I was just reading that somewhere this morning.

[Toshi_Esumi]

Do you have below configured?

config system global

  set snat-route-change enable

end

[jacky0394]

toshiesumi wrote:

Do you have below configured?

config system global

  set snat-route-change enable

end

Yes, still the same after enable

64 bytes from 8.8.8.8: icmp_seq=23 ttl=114 time=61.837 ms 64 bytes from 8.8.8.8: icmp_seq=24 ttl=114 time=51.808 ms 64 bytes from 8.8.8.8: icmp_seq=25 ttl=114 time=25.729 ms Request timeout for icmp_seq 26 Request timeout for icmp_seq 27 Request timeout for icmp_seq 28 Request timeout for icmp_seq 29 Request timeout for icmp_seq 30 Request timeout for icmp_seq 31 Request timeout for icmp_seq 32 Request timeout for icmp_seq 33 Request timeout for icmp_seq 34 Request timeout for icmp_seq 35 Request timeout for icmp_seq 36 Request timeout for icmp_seq 37 Request timeout for icmp_seq 38 Request timeout for icmp_seq 39 Request timeout for icmp_seq 40 Request timeout for icmp_seq 41 Request timeout for icmp_seq 42 Request timeout for icmp_seq 43 Request timeout for icmp_seq 44 Request timeout for icmp_seq 45 Request timeout for icmp_seq 46 Request timeout for icmp_seq 47 Request timeout for icmp_seq 48 Request timeout for icmp_seq 49 Request timeout for icmp_seq 50 Request timeout for icmp_seq 51 Request timeout for icmp_seq 52 ^C (Killed) --- 8.8.8.8 ping statistics --- 54 packets transmitted, 25 packets received, 53.7% packet loss round-trip min/avg/max/stddev = 3.412/33.286/73.416/20.695 ms MacBook-Pro:~ jacky$ ping 8.8.8.8 PING 8.8.8.8 (8.8.8.8): 56 data bytes 64 bytes from 8.8.8.8: icmp_seq=0 ttl=116 time=18.188 ms 64 bytes from 8.8.8.8: icmp_seq=1 ttl=116 time=18.335 ms

[Toshi_Esumi]

I don't know what version of FortiOS you're running but I would open a ticket to ask TAC if this is expected behavior.

[jacky0394]

toshiesumi wrote:

Do you have below configured?

config system global

  set snat-route-change enable

end

Actually there are  questions not related to the settings itself..

1. Why it is not the default like in other dual WAN router?

2. If user is downloading large file with the default *disable* option, the user would need to download them again?

[Toshi_Esumi]

I know only 6.0-6.2. But No.1 is my question too, "Why not default?". For a large file transfer, likely it's based on TCP, which would detect packet loss and initiate retrasmission.