SD WAN issue

jensthms · ‎07-14-2019

I was trying to do SD WAN cofiguration in fortinet VM(6.0) in gns3 before going live in production. But i cant add members to SDWAN, it shows error FAILED DEPENDENCY. What could be the reason?. I also checked whether the interface adding is there in any policy. I can add one interface to SDWAN,when adding second one it shows failed dependency error.

Dave_Hall · ‎07-17-2019

Try diagnose sys cmdb refcnt show system.interface.name <interface name>

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C

View solution in original post

Dave_Hall · ‎07-18-2019

Possible suggestion:

Add port2 to the SDWAN by itself and save that cfg then load an unencrypted backup copy into a text editor and add port3 to the SDWAN members. Load that back into the fgt vm - try to monitor the console output while it is booting and/or perform diagnose debug config-error-log read at the CLI after you gain access the console.

The above method is ugly in my opinion, but may work. I recall an old bug from the 4.3/5.0 days where just doing something in the GUI causes certain interfaces to "become dependence". That said, as a suggestion it maybe remotely possible that this problem is browser related - try using a different browser.

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C

View solution in original post

hubertzw · ‎07-15-2019

Check routing and firewall policies, VPN, etc.

jensthms · ‎07-15-2019

i checked that..interfaces are not linked in any of those sections(ipv4 policy,vpn,routing etc) Iam configuring it from scratch..

Toshi_Esumi · ‎07-15-2019

Get in CLI and "show | grep -f INTERFACE_NAME"

If it doesn't show anything other than the interface config, you might need to reboot it.

jensthms · ‎07-17-2019

I also checked by rebooting, issue is still there.

hubertzw · ‎07-17-2019

Try to save the settings without gateway IPs

jensthms · ‎07-17-2019

Checked without gateway..same error failed dependency.

Dave_Hall · ‎07-17-2019

Try diagnose sys cmdb refcnt show system.interface.name <interface name>

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C

emnoc · ‎07-17-2019

Like others mention you have something tied to the member. Policy, dhcp,prober,etc........This one problem in SDWAN, you should ALWAYS deploy the firewall with SDWAN and one member regardless if you foresee you adding a 2nd or 3rd member later on..

Ken Felix

PCNSE

NSE

StrongSwan

hubertzw · ‎07-17-2019

emnoc wrote:
Like others mention you have something tied to the member. Policy, dhcp,prober,etc........This one problem in SDWAN, you should ALWAYS deploy the firewall with SDWAN and one member regardless if you foresee you adding a 2nd or 3rd member later on..

Interesting, is there any official recommendation or good practice from Fortinet?