New Member

Solved

Can't navigate with two wan conntected

Forum|Forum|7 years ago
February 8, 2019
4 replies
4621 views

Hi Guys,

i need help because after i've connected a second wan internet connection to split and force my guest lan to navigate with the new line and divide traffic with administrative lan, the forwarding traffic outside from my office stopped work. After that my fw stopped to route the internal lan traffic to outside.

My settings are these:

wan1: 10.0.0.200 gw: 10.0.0.1

lan2 (configured as wan interface): fw address 192.168.1.200 gw: 192.168.1.1

Lan1 (internal lan): 192.168.0.x

lan3 (guest lan): 192.168.100.x

Static routes:

0.0.0.0/0 to wan1 10.0.0.1 (ip modem) - distance 10.

0.0.0.0/0 to lan2 192.168.1.1 (ip modem) - distance 10.

address configuration:

i've define an address corresponding to my lan3 ip range "LANGUEST" = 192.168.100.0/24

Policy Routes:

From:

lan3("LANGUEST") to --> lan2 (wan guest) ALL | always | ALL --> accept

implicit deny all

From:

lan1(internal) to --> wan1 ALL | always | ALL --> Accept

From:

lan1(internal to --> lan2 (wan guest) deny

From:

lan3("LANGUEST") to --> wan1 deny.

Anyone have some clue to help me understanding what is wrong?

Thank you very much in advance.

Best answer by lobstercreed

Hi Michele,

I'm a little confused about the part you have listed as "policy routes". It looks more like the "firewall policies" than "policy routes". If you don't have any policy routes configured, then ECMP might try to send traffic down a path that you have denied with firewall policies. If this were the case, I would expect some randomness to whether it works or doesn't.

Add some policy routes and you should be in good shape. If you need help with that, PM me and I can arrange some time to assist. I'm sure you can figure it out though. :)

- Daniel

lobstercreedAnswer

New Member

Hi Michele,

I'm a little confused about the part you have listed as "policy routes". It looks more like the "firewall policies" than "policy routes". If you don't have any policy routes configured, then ECMP might try to send traffic down a path that you have denied with firewall policies. If this were the case, I would expect some randomness to whether it works or doesn't.

Add some policy routes and you should be in good shape. If you need help with that, PM me and I can arrange some time to assist. I'm sure you can figure it out though. :)

- Daniel

Dave_Hall

New Member

Hi Micky182.

It doesn't sound like you have load-balancing setup for the WAN connections (either SD-WAN or WAN LLB) - If not, you may want to consider it as you can set up priority rules for directing tje guest lan traffic to one of the WAN connection.

WAN LLB Rules.JPG

Micky182Author

New Member

Hi,

Thank you very much for your reply. I've made some mistakes with policy routes. After your help i've setup correctly now my fortigate is working great!!

Sign up

Login with SSO

Login to the community

Login with SSO