Access / routing from Wan1 to Wan2

Do you use Policy-Routing? Sounds like you force your web-users to wan2, but then you also maybe force " web-users to your-web-server" to wan2 which isn' t there!

Basically yes, i use policy based routing. I thought the fortinet somehow can " reroute" traffic when its serves both IP-Adresses. I could make a route-policy for traffic going to our Internal Server but what should I enter? The external gateway as I have for the other rules for that IP though the traffic should stay somehow inside? Thanks

I tried this now but somethings wrong. I have a rule allwoing my PC all traffic to wan2. I have a rule allowing my PC all traffic to wan1. (To be on the safe side) I have a virtual IP allwoing the inbound connection for the webserver and a static route for the webserver for wan1 I have a static route for my PC to go to the gateway on wan2 When I try to reach the Webserver (with his public IP which is the IP for the interface on wan1) The connection times out. I mad a static route for Traffic going to the Webserver-IP to go out on the WAN1-Gateway but this doesnt help. Is there something I forgot?

BTW: I forgot to mention: Ping works, but http not.

Wouldnt you need an rule like so; Source Int: Internal Source IP: Lan (or your pc) Dest Int: Wan1 Dest IP: VIP NAME !!!! Service: any Nat disabled. I would expect that to work, as i wouldnt expect routing to come into play, as its purely internal routing that would be taking place, as to the fortinet, the VIP address would be a directly connected subnet.

If I understanding you correctly.. Your users on the LAN are not able to access your web server which is on your LAN correct?

The most secure and recommend solution is to configure a split dns. You should never loop back through a firewall. (not just fortigate but any firewall/Proxy) A user should not leave the firewalls public interface to come back into the internal network.

I cannot agree to this, because the user will NOT leave the firewalls public interface in the scenario bob mentioned! I often encounter this scenario (web-server internally, addressed via public ip)... And in most cases it is done via 2 implicit policies (which in the most cases are there) internal -> wan (nat checked) wan -> internal (whatever server via VIP) For the web-server the internal users will look like internet-users, because they use the nat-pool or adress from the firewall. Using split DNS can be a good answer to many questions in many situations, but makes a lot of work depending on the scenario... and is often just another point of a possible failure.... For the scenario described above: Remeber that a route policy will REALLY FORCE traffic as written in the route policy: A policy like.... source: internal (0.0.0.0/0) protocol: 6 port 80 route to: wan2 (whatever gateway, mainly 0.0.0.0) .... will really force ALL http traffic from internal to the wan2 gateway, even you have a dmz or other networks, that should use other routes!!!!

What??? Ok first please agree with my statement that it is a security risk to exit a firewall to access internal resoucres. If he has a policy that forces port 80 traffic through wan2 and the web server is accessed with wan1 then how is it not leaving the public interface?

For the web-server the internal users will look like internet-users

That' s becuase they are internet users. Split DNS is very easy...if he is using AD it would take 3 seconds to resolve this issue. How is it another point of failure?

Technically that is still a loopback because you start out on interface A to travel to interface B to arrive back at interface A. Why would you want to go through the trouble of configuring your firewall to route the traffic and put an extra load on the firewall when the user could simply just access the web server directly. If it is on the same network the firewall should not do any routing.