0

I am using a Fortigate 1000c working on NAT mode. It has two WAN connections (WAN1 and WAN2). I am using a static route.

For some reasons, There are many firewalls and routers (Cisco, TP-Link and so...) are connected to it from inside on a specific VLAN. (i.e VLAN-42 used for routers) and The routers have static local IPs.

When I changed the route of this VLAN (in the Fortigate) and force it to outgo from WAN2 instead of WAN1. The routers couldn't access the internet until rebooting?!

So, Why they have to reboot their router after I change the static route? Because the one who rebooted, get the internet service. But others stayed stuck with no internet access for two days after that, they rebooted and got connected.

Many thanks.

| improve this question | |
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin♦ Feb 21 '18 at 17:42
1

just a guess, but a possible cause of this is the presence of active NAT translations.

Since there's existing translations in the NAT table the connections from the internal devices will match those translations which are valid for WAN1, and try to go out WAN1. Since the route doesn't exist anymore the connection fail.

Each tentative will refresh the timeout of the NAT entry and so the issue persist until the NAT table is cleared.

| improve this answer | |
  • Do you think the internal router reboot will affect the NAT table in the Fortigate? Because I didn't restart the Fortigate, But I restarted the internal routers to resolve this issue and it did. So, If I restart the Fortigate itself, I will not need to restart each router? – Basem Abdulrahem Sep 13 '17 at 15:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.