dual WAN, but not load balancing nor ECMP

[Agent_1994]

Hello!

 I've the following situacion on a customer's site:

[ul]

Fortigate connected to two WAN links, both via an ethernet cable. Let's call them WAN_A and WAN_B.

These links are connected to the same VDOM.

WAN_A is the default gateway. WAN_B will just listen for connections to a SSL VPN and will have certain virtual IPs, it wont be used as a default gateway nor load balancer.

There is a 0.0.0.0/0.0.0.0 (default) static route pointing to GW_WAN_A on WAN_A's interface.

For the time being, i've enabled PING on WAN_B.[/ul]

 How do i make this work?, i've tried:

[ul]

Another default route to GW_WAN_B with a higher administrative distance. Didn't work (can't ping).

A policy route with the following specs: [ul]

Incoming interface: WAN_B

Protocol: ANY

Source Address/Mask: 0.0.0.0/0.0.0.0

Destination Address/Mask: WAN_B_IPS/MASK

Action: Forward traffic

Outgoing interface: WAN_B

Gateway Address: GW_WAN_B[/ul]

The policy route triggered the RPF, i've disabled it but it didn't work either.[/ul]

 I'd appreciate if anyone can point me in the right direction.

 Greets.

[Agent_1994]

Hello,

 This is how it looks without any policy routing nor static route to WAN_B_GW. As you can see, pings to WAN_B are being replied through WAN_A.

# diagnose debug flow...

id=20085 trace_id=270 func=print_pkt_detail line=4484 msg="vd-proxy received a packet(proto=1, 201.216.226.217:62464->WAN_B:8) from port4. code=8, type=0, id=62464, seq=33." id=20085 trace_id=270 func=resolve_ip_tuple_fast line=4545 msg="Find an existing session, id-16434038, original direction" id=20085 trace_id=271 func=print_pkt_detail line=4484 msg="vd-proxy received a packet(proto=1, WAN_B:62464->201.216.226.217:0) from local. code=0, type=0, id=62464, seq=33." id=20085 trace_id=271 func=resolve_ip_tuple_fast line=4545 msg="Find an existing session, id-16434038, reply direction"

# diagnose sys session list

session info: proto=1 proto_state=00 duration=28 expire=56 timeout=0 flags=00000000 sockflag=00000000 sockport=0 av_idx=0 use=3 origin-shaper= reply-shaper= per_ip_shaper= ha_id=0 policy_dir=0 tunnel=/ vlan_cos=8/8 state=local may_dirty statistic(bytes/packets/allow_err): org=360/6/1 reply=360/6/1 tuples=2 orgin->sink: org pre->in, reply out->post dev=10->24/24->10 gwy=WAN_B/0.0.0.0 hook=pre dir=org act=noop 201.216.226.217:62464->WAN_B:8(0.0.0.0:0) hook=post dir=reply act=noop WAN_B:62464->201.216.226.217:0(0.0.0.0:0) misc=0 policy_id=0 auth_info=0 chk_client_info=0 vd=2 serial=164a8703 tos=ff/ff ips_view=0 app_list=0 app=0 dd_type=0 dd_mode=0 npu_state=00000000 total session 1

# diagnose ip rtcache list

family=02 tab=254 vf=2 type=02 tos=0 flag=80000200 201.216.226.217@10(port4)->WAN_B@24(proxy) gwy=0.0.0.0 prefsrc=WAN_B ci: ref=2 lastused=3 expire=0 err=00000000 used=0 br=0 pmtu=1500 family=02 tab=254 vf=2 type=01 tos=0 flag=00000200 WAN_B@0->201.216.226.217@9(port3) gwy=WAN_A_GW prefsrc=0.0.0.0 ci: ref=1 lastused=3 expire=0 err=00000000 used=1 br=0 pmtu=1500