Skip to main content
mdnoor
mdnoor
New Member
December 16, 2020
Question

Add ISP to WAN2 (FortiGate 60E)

  • December 16, 2020
  • 2 replies
  • 15000 views

Hi all,

 

im new in fortigate currently we use fortigate 60e and inside already config use wan1 from ISP setup by previous people, now the company just purchase new ISP from different ISP which is i need to add at WAN2 but after i follow the cookbook config i unable to connect the internet for wan2. can some one help me how can i config wan2?

 

in picture i already remove back the config

 

reference basic config:

https://docs.fortinet.com...ecting-network-devices

 

    2 replies

    Markus
    Markus
    New Member
    December 16, 2020

    Hi, and welcome to the forums You have to configure Wan2 accordingly to your new ISP settings (IP, Subnet) and you have to change the default route to the new (ISP) gateway. But be carefull, this will break your wan1 internet access and any policy that is going to wan1. What is the plan, to use both ISPs in the future? If so, maybe SD-WAN https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/19246/sd-wan is an option for you. Anyhow, you have to change the config and policies anyway. For testing wan2 after you have setting up correctly, you can configure a route to a specific URi or host, let's say google.ch, make a policy and check if you can reach. For smooth migration, you can copy paste all the policies going to wan1 and change them to wan2 (having all then twice -> internal -> wan1 | internal -> wan2). Then you change the default route. If anything is working fine over wan2, you can delete the wan1 policies. Otherwise you change back the default route and you are fast back with internet access. You can also save a config backup and change all wan1 policies to wan2 with a text editor and upload the config. But this is not the best way if your box is in production. It will reboot the box and if there is some mistake, you probaly will break the access and/or your inet access.

    mdnoor
    mdnoorAuthor
    New Member
    December 17, 2020

    hi thanks for reply so to compromise ur explanation that means i need to do like this

     

    after i finish this step

    https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/428376/configuring-interfaces

     

    all the thing i need to do is routing and policy setting, and for internal setting is internal LAN right must create and assign ip for both diffrent ip?

    INTERNAL -> WAN1

    INTERNAL -> WAN2

     

    after finish testing both connection then only i can start config for redundancy right?

     

    Regards & Thanks

    mdnoor
    mdnoorAuthor
    New Member
    December 19, 2020

    hi markus thanks for explanation last time i have sucefully point wan2 isp to fortigate 60e, but it still using wan1 as main internet unless wan1 down it will switch to wan2.

     

    so here wan2 is backup unless i create wan load-balancing as you said before only then it will use both isp.

    so next step is to create wan laod-balancing as i have to delete the routing and ipv4 policy then create new.

     

    thanks again

    regards 

    noor

     

     

    mdnoor
    mdnoorAuthor
    New Member
    December 17, 2020

    hai markus.

     

    do i have to create internal lan for wan2 also ?

     

    as i test using wan2 using internal port lan1&2 which is previous setup from another isp(wan1) can get internet.

     

    sw2090
    SuperUser
    sw2090
    SuperUser
    December 22, 2020

    there is bascially two ways to achieve that:

     

    1. Two seperate WANs (WAN1 and WAN2) with sperate ISPs. In this case you have to create two default routes. If yu want WAN2 to be fallback in this constellation make sure that the default route for WAN2 has the higher priority/distance than the WAN1 one.

    If there is more than one route for a target (in this case the internet) routes are matched by priority and then distance. So traffic would primarily use the WAN with loweset routing prio and then if that don't work use the other one. This has the disadvantage that there will be no real loadbalancing - just failover.

    Also you need to have every internet policy twice (one for every WAN).

     

    2. Use SD-WAN instead. In this case you need only one default route that uses sd-wan as interface. All Internet policies must use sd-wan as interface for traffic from/to the internet.

    SD-WAN implements several loadbalancing algorithms and also allows you to set own rules for balancing.

    Once you also set up some SD-WAN health check(s) the sd-wan also cares for failover. When the health check(s) detect a WAN being unavailable it will automatically be dropped from sd-wan and is no longer used. Once health check reports the WAN being ok again it will automatically turn back into action and will be used again.

    So you need less policy and routes. Also you don't need to change anything in tohe routing when a WAN goes down. SD-WAN does that automatically.

    Disadvantage: (the only one I yet found for me) Using SD-WAN prevents you from having additional default routes. So if you want to have some WAN outside SD-WAN as fallback - that' snot possible with sd-wan.

    (We would like to use cellular uplink as extra fallback but it would need to be outside sd-wan because using it is expensive and you cannot prevent sd-wan from using it once it is in there.)

     

    SecurityPlus
    SecurityPlus
    Explorer III
    December 23, 2020
    Concerning #2 from sw2090, does FortiOS 6.4 add some additional options concerning SD-WAN management options?
    Terms & ConditionsAccessibility statement