Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor III

Traceroute choosing available interface member lower in the list

Hello Community

The setup is a FortiWifi 80F running on v7.2.6 firmware. There is two WAN choices on this appliance using either a virtual switch including WAN1 and WAN2 or separate from the virtual switch option port A. The SD-WAN rule has the virtual switch (WAN1, WAN2) as the first choice the port A as the second choice. The behavior I am seeing seems to contradict this order.

1. Unplug any connection from port A (last item in the SD-WAN list) and only use WAN1.

2. Set WAN1 to static address.

3. Execute traceroute does complete.


4. Plug in to the port A with a wireless access point connected via DHCP.

5. Execute traceroute does complete but it does through the port A. Port A is lower in the list the expectation is to use the software switch (WAN1) first when available.


Why does the traceroute choose port A when WAN1 is set to static mode? If I instead port WAN1 on DHCP, and again try traceroute it does choose the software switch first.


The desired behavior would be to have WAN1 on static with the port A plugged in. Then traceroute will choose WAN1 every time.


Appreciate it


You can use the below command to allow FortiOS traceroute tool to use SD-WAN:

execute traceroute-options use-sdwan yes
execute traceroute


New Contributor III

Thank you for the fast response!

I have tired the traceroute-options use-sdwan yes, but it does still prefer to using port A.


Then it would be best for you to perform a flow debug and see which proute is used to route the affected traffic. Reference:


You can then check the proute ID as explained at .


To understand why certain proutes are not configured based on your expectations, you can check SD-WAN debug outputs explained at .


In general though, I would not spend too much time trying to troubleshoot a Fortigate local-out traceroute issues as it's likely not important to you. You should rather focus on troubleshooting any potential issues from client devices.


If you require more help with SDWAN debugging, I think opening a support ticket with TAC will be the most optimal way to move forward.

Top Kudoed Authors