SD-WAN + IPSEC VPN TUNNEL

[vusal_d]

Hello,

We finally purchased second ISP link and I did immediately migrated to SD-WAN.I

I did required config, and it works, but not in the way I expected. By some reason, my routing get messed and I cant find the reason why, but found a way to workaraound

For example When I traceroute remote site Ip, in working state I get answer 

C:\Users\vusal.d>tracert 172.16.212.115

Tracing route to 172.16.212.115 over a maximum of 30 hops

1 <1 ms <1 ms <1 ms 172.16.211.254
2 1 ms <1 ms <1 ms 10.9.65.2
3 1 ms <1 ms <1 ms 172.16.212.115

Trace complete.

But if I reboot remote side fortigate or disable its internet facing interface, after tunnel connection is established, then enable it again tracert gives me, 

C:\Users\vusal.d>tracert 172.16.212.115

Tracing route to 172.16.212.115 over a maximum of 30 hops

1 <1 ms <1 ms <1 ms 172.16.211.254
2 1 ms <1 ms 2 ms 217.25.18.1
3 1 ms <1 ms <1 ms 10.10.80.9
4 1 ms 1 ms 1 ms 109.235.192.93
5 2 ms 1 ms 1 ms 10.240.3.10
6 8 ms 7 ms 8 ms 212.46.241.89
^C

Please not, that tunnel is up and running, SD wan diagnose command says that all is ok, I can see peers and so on, but there is no traffic from my side. I get request time out on ping remote IP address, until I execute below command on my FortiGate

diagnose sys session clear

Which equals to reboot Then I can ping again and routing works ... If I reboot my FortiGate, I will lose traffic as well. I will have to disable second ISP link, disable root 0.0.0.0 > virtualwan-link, then

diagnose sys session clear

After it work again, then I reenable route and WAN2 interface

WHY?

Any one with the same issue ?

[tthrilok]

Hi Vusal_d,

As per your statement, that it is working after running the command:

diagnose sys session clear

It could be that traffic is matching the session which is already existing.

I get request time out on ping remote IP address, until I execute below command on my FortiGate <<<<<<<<<< Is it you are doing a continuous ping to the remote LAN network and you are not receiving the response back, if it is the continuous ping initiated when your tunnel is down, there would be a session created which has ingress and egress interfaces mapped. Now when your tunnel came up, firewall would not do a route lookup as already there was a session established, it would only match the old session matching the 5 tuples

So could you please confirm, if you are seeing the no response when the new ping is initiated from a new tab, after the tunnel came back up. Please confirm! 

[seshuganesh]

Hi Team,

You are doing tracert from windows which will have deault TTL of 60 seconds, it means for 60 seconds session will be persisted in the fortigate firewall.

Seems like there could be some session for the same remote gateway for ICMP packets.

Also,  please check if preserve session route is enabled in the fortigate wan interface:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Enabling-the-preserve-session-route/ta-p/1...

If it is enabled even if there is a routing change existing sessions will still use the same link