Hello Community
The setup is a FortiWifi 80F running on v7.2.6 firmware. There is two WAN choices on this appliance using either a virtual switch including WAN1 and WAN2 or separate from the virtual switch option port A. The SD-WAN rule has the virtual switch (WAN1, WAN2) as the first choice the port A as the second choice. The behavior I am seeing seems to contradict this order.
1. Unplug any connection from port A (last item in the SD-WAN list) and only use WAN1.
2. Set WAN1 to static address.
3. Execute traceroute 8.8.8.8 does complete.
4. Plug in to the port A with a wireless access point connected via DHCP.
5. Execute traceroute 8.8.8.8 does complete but it does through the port A. Port A is lower in the list the expectation is to use the software switch (WAN1) first when available.
Why does the traceroute choose port A when WAN1 is set to static mode? If I instead port WAN1 on DHCP, and again try traceroute it does choose the software switch first.
The desired behavior would be to have WAN1 on static with the port A plugged in. Then traceroute will choose WAN1 every time.
Appreciate it
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
You can use the below command to allow FortiOS traceroute tool to use SD-WAN:
execute traceroute-options use-sdwan yes
execute traceroute 8.8.8.8
Thank you for the fast response!
I have tired the traceroute-options use-sdwan yes, but it does still prefer to using port A.
Then it would be best for you to perform a flow debug and see which proute is used to route the affected traffic. Reference: https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/54688/debugging-the-packet-f...
You can then check the proute ID as explained at https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-find-out-the-Policy-Route-Types/ta-... .
To understand why certain proutes are not configured based on your expectations, you can check SD-WAN debug outputs explained at https://docs.fortinet.com/document/fortigate/6.2.16/cookbook/818746/sd-wan-related-diagnose-commands .
In general though, I would not spend too much time trying to troubleshoot a Fortigate local-out traceroute issues as it's likely not important to you. You should rather focus on troubleshooting any potential issues from client devices.
If you require more help with SDWAN debugging, I think opening a support ticket with TAC will be the most optimal way to move forward.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1702 | |
1092 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.