| Description |
This article describes the setting to fix the issue from remote FortiGate to FSSO Agent over IPSec tunnels that are members of the SDWAN zone. |
| Scope |
All FortiGate all v6.2.6 to v7.2.0, except 6.4.0 and 6.4.1. |
| Solution |
Topology:
FSSO_Agent---HQ_FGT---IPSEC---(SDWAN)Branch_FGT
Branch_FGT = Branch FortiGate HQ_FGT = Head Quarter FortiGate
Assuming two IPSec VPN tunnels are configured between both the FortiGates over dual ISP respectively.
These two IPSec VPNs are members of an SDWAN zone at Branch_FGT and SDWAN rule is set to choose the IPsec tunnel based on Best Quality.
(Note: SDWAN rule could be anything as per requirement)
FSSO Agent is deployed on the HQ side and is reachable from HQ_FGT but not reachable from Branch_FGT.
After configuring the FSSO External connector, the connection status shows down.
When using SDWAN, the set interface-select-method must be set to 'sdwan'.
By Default it is set to Auto:
When interface select method is set to ‘auto’ it will not follow SDWAN rules and the traffic will not go out through SDWAN.
# config user fsso edit " DC1 " << Agent Name set server 10.1.1.2 set source-ip "X.X.X.X" << IP address of transit Network set interface-select-method auto
To fix the issue, edit the FSSO configuration from CLI and set the set interface-select-method to sdwan.
When interface select method is set to ‘sdwan’ the traffic will go out through the particular interface as per the SDWAN rule and the connection will be established.
# config user fsso edit " DC1 " << Agent Name set server 10.1.1.2 set source-ip "X.X.X.X" <<IP address of transit Network set interface-select-method sdwan
Results: When any one member interface (in this case IPSec Interface) of SDWAN goes down the FSSO Agent stays connected.
# get vpn ipsec tunnel summary 'IPsec_tunnel_1' 192.168.1.1:0 selectors(total,up): 1/1 rx(pkt,err): 2/0 tx(pkt,err): 6686246/624 ' IPsec_tunnel_2' 10.174.0.182.2:0 selectors(total,up): 1/0 rx(pkt,err): 0/0 tx(pkt,err): 0/1684
# diagnose debug authd fsso server-status Server Name Connection Status Version Address ----------- ----------------- ------ ------- DC1 connected FSSO 5.0.0304 10.1.50.11
# get vpn ipsec tunnel summary 'IPsec_tunnel_1' 192.168.1.1:0 selectors(total,up): 1/0 rx(pkt,err): 0/0 tx(pkt,err): 0/624 ' IPsec_tunnel_2' 10.174.0.182:0 selectors(total,up): 1/1 rx(pkt,err): 2/0 tx(pkt,err): 987486/1684
# diagnose debug authd fsso server-status Server Name Connection Status Version Address ----------- ----------------- ------- ------- DC1 connected FSSO 5.0.0304 10.1.50.11 |
