ADDITIONAL ISP on Fortigate 100D

You'll need to use policy routing in order to make that work.

Add the WAN2 interface with the new ISP. Add a default route to it, with distance 10 and priority 10 (if your wan1 default route is distance 10 and priority 0 - Use the same distance as WAN1, but LOWER priority on WAN2 (higher number).)

Create the firewall policies for your user networks that sends them out on WAN2 with NAT etc etc.

Create policy routes for your user networks that STOP policy routing when the destination is:

192.168.0.0/16

172.16.0.0/12

10.0.0.0/8

This is needed because otherwise the clients shouldn't be able to reach anything internal - They are forced out on WAN2 by the rule below here. It is important that these rules that stop policy routing is on top of the ruleset, BEFORE the rule that does the actual policy routing.

Create policy routes for your user networks that forwards the traffic to destination network 0.0.0.0/0 -> WAN2, do not specify gateway address, use 0.0.0.0.

Configure link monitors for wan1 and wan2 in cli that pings something out on the internet that's always up, like Google's A/B-DNS:

(Set the interval/timeout/failtime/recoverytime to your liking, value is in seconds)

configure system link-monitor

edit monitor-wan1

set srcintf wan1

set server 8.8.8.8

set protocol ping

set gateway-ip x.x.x.x (your gateway on wan1)

set source-ip x.x.x.x (your wan1 IP)

set interval 5

set timeout 5

set failtime 5

set recoverytime 5

set update-static-route enable

set status enable

next

edit monitor-wan2

set srcintf wan2

etc etc... Do the rest the same as the monitor for wan1...

next

end

Now, if you want the user networks to be able to fall over to WAN1 if WAN2 fails, create rules pointing them to WAN1 also. Or create a zone (I would call it "INTERNET"...) with both wan1 and wan2 in it, and point all traffic going out to that zone. The policy routing and the regular routing table will take care of the traffic, everything that isn't policy routed will go out on wan1 according to the routing table. The link monitor will update the routing table when a link fails and remove all routes to the monitored interface.

So, if WAN1 fails, the default route is removed, and the traffic will hit the next default route, and use that.

Same with the traffic that you policy routed out on WAN2; as long as you only specify interface, and not gateway address, the traffic will go out on the interface that has the default route wich is WAN1 if WAN2 fails.

:)

General routing uses the destination address as the decision (and both the clients and servers will likely be accessing similar Internet resources) so a typical default route will send all traffic out a single interface. You will need to use policy-based routing which can route based on information other than destination - and in this case you want a decision based on source address. You will need two "source address" policy routes, one for the clients pointing toward the WAN2 ISP and one for the servers pointing toward the WAN1 ISP.