Traceroute choosing available interface member lower in the list

[AskingForHelp]

Hello Community

The setup is a FortiWifi 80F running on v7.2.6 firmware. There is two WAN choices on this appliance using either a virtual switch including WAN1 and WAN2 or separate from the virtual switch option port A. The SD-WAN rule has the virtual switch (WAN1, WAN2) as the first choice the port A as the second choice. The behavior I am seeing seems to contradict this order.

1. Unplug any connection from port A (last item in the SD-WAN list) and only use WAN1.

2. Set WAN1 to static address.

3. Execute traceroute 8.8.8.8 does complete.

4. Plug in to the port A with a wireless access point connected via DHCP.

5. Execute traceroute 8.8.8.8 does complete but it does through the port A. Port A is lower in the list the expectation is to use the software switch (WAN1) first when available.

Why does the traceroute choose port A when WAN1 is set to static mode? If I instead port WAN1 on DHCP, and again try traceroute it does choose the software switch first.

The desired behavior would be to have WAN1 on static with the port A plugged in. Then traceroute will choose WAN1 every time.

Appreciate it

[bpozdena_FTNT]

You can use the below command to allow FortiOS traceroute tool to use SD-WAN:

execute traceroute-options use-sdwan yes
execute traceroute 8.8.8.8

[AskingForHelp]

Thank you for the fast response!

I have tired the traceroute-options use-sdwan yes, but it does still prefer to using port A.

[bpozdena_FTNT]

Then it would be best for you to perform a flow debug and see which proute is used to route the affected traffic. Reference: https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/54688/debugging-the-packet-f...

You can then check the proute ID as explained at https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-find-out-the-Policy-Route-Types/ta-... .

To understand why certain proutes are not configured based on your expectations, you can check SD-WAN debug outputs explained at https://docs.fortinet.com/document/fortigate/6.2.16/cookbook/818746/sd-wan-related-diagnose-commands .

In general though, I would not spend too much time trying to troubleshoot a Fortigate local-out traceroute issues as it's likely not important to you. You should rather focus on troubleshooting any potential issues from client devices.

If you require more help with SDWAN debugging, I think opening a support ticket with TAC will be the most optimal way to move forward.