Technical Tip: Internet is not working with one of the SD-WAN member when IP pool is called in the policy

[phaldikar_FTNT]

Description
This article describes the issue, Internet is not working with one of the SD-WAN member when IP pool is called in the policy.

Solution
User may face the issue while accessing internet when there is aoutgoing interface as SD-WAN with more than one WAN interface, such as WAN1 and WAN2 in the same firewall policy and uses the IP pool to do SNAT.

# config system interface
    edit "wan1"
        set alias to_ISP1
        set mode dhcp
    next
        edit "wan2"
            set alias to_ISP2
            set ip 1.1.10. 255.255.255.248
        next
    end

# config system sdwan
    set status enable
# config members
    edit 1
        set interface "wan1"
    next
        edit 2
            set interface "wan2"
            set gateway 1.1.10.6
        next
    end
end

# config firewall ippool
    edit "1.1.10.1"
        set startip 1.1.10.1
        set endip 1.1.10.5
    next
end

# config firewall policy
    edit 1
    set srcintf "port2"
    set dstintf "sdwan"
    set srcaddr "all"
    set dstaddr "all"
    set action accept
    set schedule "always"
    set service "ALL"
    set logtraffic all
    set logtraffic-start enable
    set ippool enable
    set poolname "1.1.10.1"
    set nat enable
next

In this case, if traffic goes via WAN1 with SNAT as 1.1.10.1, internet will not work.

To overcome the issue, it is necessary to set 'associated-interface' in the IP pool.

# config firewall ippool
    edit "1.1.10.1"
        set type overload
        set startip 1.1.10.1
        set endip 1.1.10.5
        set associated-interface 'wan2'
        set comments ''
    next
end

With this, IP pool will be applied only when traffic is going via WAN2 interface.
Traffic going via WAN1 will use WAN1 interface IP for SNAT.