2 ISPs - I want to keep them totally separate - 1 for Guest traffic and 1 for Internal

Forum|Forum|10 years ago
October 25, 2015
5 replies
6027 views

FortiGate 200D 5.2.4 Transparent Mode

Setup - Internal

WAN1 - Internal ISP Router - 66.x.x.x

Port 16 - Internal LAN - 172.x.x.x/16

Setup - Guest

WAN2 - Guest ISP Router - 67.x.x.x

Port 1 - Guest LAN - 10.10.0.0/24

How do I set this up and make sure that the guest LAN and internal LAN traffic does not mix? Is it possible? I am a newbie w/ Fortigate... I appreciate your help!

5.2

ede_pfau

SuperUser

hi,

and welcome to the forums.

Fortigates can be "virtualized", that is, you can create up to 10 virtual firewalls on one hardware. The keyword is "VDOM" if you look up the concept in the FortiOS Handbook (@ docs.fortinet.com). Each VDOM at least needs 2 ports (input and output) but not necessarily physical ones. By default VDOMs are completely separate unless you connect them over ports.

IMHO this will enable you to build the setup you are planning.

HumongousAuthor

New Member

I will take a look! Thank you, Ede!

CyberNorris

New Member

VDOMs would add unnecessary complexity. I have a couple of clients with dual paths for outbound traffic. Corporate traffic (LAN & WLAN) use WAN1 as the primary outbound and WAN2 as the backup outbound while guests (WLAN) use WAN2 as the primary outbound and WAN1 as the backup outbound.

There are two static routes, both with equal distance. Then there are policy routes (one for each LAN or WLAN network) that direct the corp networks to WAN1 and a policy route that directs the guest network to WAN2. Adding a status check (link health monitor - advanced routing feature must be enabled) for each WAN circuit will let the FortiGate learn if a route is down... and if down it will remove that route from the routing table directing traffic normally using the policy route to the other default route.

Best of luck!