SW-WAN won't fall back after fail of one interface

[tobisfr]

Hi,

i have two FG-200E with the same behavior after updating to 5.6.11.

- SD-WAN with two interfaces in Spillover mode

- Firewall is in HA Active-Passive Mode

- Status-Check to two different ping targets ( Google and Telekom)

- If one interface can't reach the internet the Firewall is reporting it, Status-Check is red on this WAN Interface

But if the Internet is working again on this interfaces, the Firewall never activate it again. The status check keeps red.

If i then manuall deactivate and acitivate the interface under Network -> SD-WAN - the its working.

In Firmware 5.6.7 this was working fine automatically.

I Updated from 5.6.7 to 5.6.9 and then two 5.6.11

Regards,

Tobi

[sw2090]

There already is two threads about this in the community.

Short Version:

This is a known bug in 5.6.11 and acknowledged by Fortinet!

The Bug is fixed in 6.0.6 or higher already.

The Managemend has escalated the fix to be backported to 5.6.11 but no one currently knows when it will come.

As long as you can still access your FGT you could run "exec router restart" on cli to temporarily fix it.

To fix it permantley you would either have to wait for a fixed 5.6.11 image or upgrade to 6.0.6 or 6.2

hth

Sebastian

[tobisfr]

Thank for the info. Do you have any Fortinet BugID?

Just talked to Fortinet Support and they told me that there is no know issue to that in this version and they have to debug it.....

[sw2090]

#576646 and #583247

What I wrote in my first reply is confirmed by Fortinet Support in my ticket.