Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Contributor II

Two default routes and SD-WAN



I have two WAN interfaces in SD-WAN and a third WAN interface alone. I want to have two default routes, one over SD-WAN with distance 20 and one over the third interface with distance 10. The FortiGate does not allow me to do so, with a message: "You cannot have duplicated routes  on SD-WAN and non SD-WAN interfaces.".


Now, I remember that in the past, in the same FG but in different FortiOS version, I could do that. Now me FG is running 6.0.8. Has something change? Besides, I don't understand why shouldn't FortiOS allow me the option to have two default routes with different distance, no matter if I use SD-WAN or not.



New Contributor



The reason is because the system handles policy routes taking precedence over the static routes. In this case policy routes meaning SD-WAN rules. What Fortinet wants us to do is have 1 default route to SD-WAN zone and then use the rules to route the traffic. For better or worse.


Your answer is somewhere in here...


I've been in a couple situations as yours and what I do is add the 3rd WAN interface into the SD-WAN zone.

Valued Contributor

Fortinet also allows to to default routes to the different interfaces that are part of sd-wan (and then no default route to the sd-wan interface itself).


Yes, I had to set this on our devices on the advice of the TAC - if the DR is set to SD-WAN, self-originated traffic (DNS, FortiGuard etc.) does not work. Although everywhere in KB it is stated that DR should be set to SD-WAN only - it's a mess :\

Valued Contributor

i had the opposite reaction from support when i shared my setup they told me to configure the default route to the sd-wan interface. i got quite annoyed about that.


there are two ways and that should be clearly documented and supported.


as for the self-originated traffic issues i feel your pain, regular customer calls about FortiGuard traffic failing causing a manual config change until the regular interface is fine again.


6.4 is solving the only one SD-WAN interface issue, i hope the self-originated traffic is soon to follow, then finally SD-WAN is very usuable.




Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors