Strange Problem with SD WAN - Any Ideas?

[RolandBaumgaertner72]

Hey,

we have a FG60F with 7.4.4 and 3 Interner Access (all of them >500/500MB). They called me yesterday and at 1700 they had no internet. I was OoO so I asked them to ping the firewall (OK) and check lights (check of FG and Switches) and everything inside seemed normal....but that all 3 accesses fail at the same time, that never ever happened.

They rebooted FG and all routers and nothing. At the end after 1 hour I told them to reboot FG, wait 2 mins and only connect WAN1 and sudenly it worked. I am not sure that this process solved the problem but 5mins later I connected via Forticloud and in SD WAN all of them were OK.

Today checking th logs at 1700 I only find "Member status changed" and "Member status changed. Member out-of-sla." At 18:27 I find "SDWAN SLA information warning" and Message "Service disabled caused by no outgoing path."

I am not worried that this can happen soon, but maybe one of you had the same experience once?

Thanks

[Muhammad_Haiqal]

Hi @RolandBaumgaertner72 ,

Based on the log events:
"Member status changed. Member out-of-sla." At 18:27 I find "SDWAN SLA information warning" and Message "Service disabled caused by no outgoing path."

This looks like the "expected" path to internet is down due to failed SLA and went to another path. Maybe your IPSEC VPN, MPLS, etc.
Please check your SDWAN SLA threshold and configure higher value. Example: Ping interval 6000second, latency 100ms, packet loss 10%.

You may also disable "Update static route" options. However the failover will not happen if this option is disabled.

[RolandBaumgaertner72]

Hi,

but having 3 Internet Access in SD WAN with the same load balancing it should not happen, no? I dont think that all of them failed. 

Thanks!

[sw2090]

it can still happen even then - if all three memers fail to meet the sla target at the same time they all would be disabled and then there would be no path left over...

[RolandBaumgaertner72]

As I mentioned, that is really strange case. One of the Internet Acces is also used for Voip and they guaranteed that phones we working all the times....so it least one should pass the SLA.

Thanks

[RolandBaumgaertner72]

Hello,

again we got the problem and all routes for SD WAN were down. This never happened before. Also right after I put up all of my SLA Performance Check data but again it happend. 

Now I am applying no SLA and I just have the  Implicit SD-WAN rule where I spilt 33% to all acceses.

Again, at least one year with 7.4.3 no problem at all and suddenly after upgrading to 7.4.4 at least 3-4 times the problem that all routes went down. 

Its a formation center and they have lots of critical online tests right now, so we cannot change anything but any idea for a good workaround? 

Thanks