- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Two default routes and SD-WAN
Hello,
I have two WAN interfaces in SD-WAN and a third WAN interface alone. I want to have two default routes, one over SD-WAN with distance 20 and one over the third interface with distance 10. The FortiGate does not allow me to do so, with a message: "You cannot have duplicated routes on SD-WAN and non SD-WAN interfaces.".
Now, I remember that in the past, in the same FG but in different FortiOS version, I could do that. Now me FG is running 6.0.8. Has something change? Besides, I don't understand why shouldn't FortiOS allow me the option to have two default routes with different distance, no matter if I use SD-WAN or not.
Thanks
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
The reason is because the system handles policy routes taking precedence over the static routes. In this case policy routes meaning SD-WAN rules. What Fortinet wants us to do is have 1 default route to SD-WAN zone and then use the rules to route the traffic. For better or worse.
Your answer is somewhere in here...
I've been in a couple situations as yours and what I do is add the 3rd WAN interface into the SD-WAN zone.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Fortinet also allows to to default routes to the different interfaces that are part of sd-wan (and then no default route to the sd-wan interface itself).
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, I had to set this on our devices on the advice of the TAC - if the DR is set to SD-WAN, self-originated traffic (DNS, FortiGuard etc.) does not work. Although everywhere in KB it is stated that DR should be set to SD-WAN only - it's a mess :\
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i had the opposite reaction from support when i shared my setup they told me to configure the default route to the sd-wan interface. i got quite annoyed about that.
there are two ways and that should be clearly documented and supported.
as for the self-originated traffic issues i feel your pain, regular customer calls about FortiGuard traffic failing causing a manual config change until the regular interface is fine again.
6.4 is solving the only one SD-WAN interface issue, i hope the self-originated traffic is soon to follow, then finally SD-WAN is very usuable.
