Traffic dropped with Virtual Server and DNAT in SD-WAN + Central NAT setup

[Clement8746]

Hello,

I'm facing a traffic drop issue when trying to use FortiGate's load balancing feature via Virtual Servers.

 Setup:

• FortiGate with Central NAT enabled
• Interfaces:
  • frontend: 192.168.1.1 with secondary IP 192.168.1.2
  • wan1: 20.20.20.20 (anonymized), member of SD-WAN zone "SDWAN"

When I configure the Virtual Server to listen directly on the wan1 interface, everything works fine.

However, for internal reasons, I need the Virtual Server to listen on a VIP.

So I created a DNAT rule:

20.20.20.20 → 192.168.1.2

The Virtual Server is configured to listen on the wan1 interface (since I cannot select the SD-WAN zone directly).

In this setup, traffic no longer works. When debugging, I get the following error:

2025-10-10 11:48:07 id=65308 trace_id=411 func=init_ip_session_common line=6070 msg="allocate a new session-5355a635"
2025-10-10 11:48:07 id=65308 trace_id=411 func=get_new_addr line=1265 msg="find DNAT: IP-192.168.1.2, port-0(fixed port)"
2025-10-10 11:48:07 id=65308 trace_id=411 func=fw_pre_route_handler line=187 msg="VIP-192.168.1.2:8728, outdev-wan1"
2025-10-10 11:48:07 id=65308 trace_id=411 func=__ip_session_run_tuple line=3446 msg="DNAT 20.20.20.20:8728->192.168.1.2:8728"
2025-10-10 11:48:07 id=65308 trace_id=411 func=vf_ip_route_input_common line=2612 msg="find a route: flag=80000000 gw-192.168.1.2 via root"
2025-10-10 11:48:07 id=65308 trace_id=411 func=__iprope_tree_check line=539 msg="gnum-100004, use addr/intf hash, len=14"
2025-10-10 11:48:07 id=65308 trace_id=411 func=fw_local_in_handler line=611 msg="iprope_in_check() check failed on policy 0, drop"

I've searched online and found some leads, but nothing has worked so far. Has anyone successfully implemented something similar?

Thanks in advance for your help!

Best regards,