Skip to main content
kxs
kxs
New Member
February 10, 2024
Question

dual WAN 1 Tunnel

  • February 10, 2024
  • 4 replies
  • 2247 views

Hello, I have a big problem. The HQ has two WANs with 2 different ISPs.
I would like to route the HQ's Internet traffic over WAN1 and create a tunnel to the branch office over WAN2.

The problem is that as soon as I enable WAN2 all clients from LAN1 try to connect over WAN2.

The configuration here:

WAN1 = Network > Interfaces > ppoe = O.K
WAN2 = Network > Interfaces > ppoe (VLAN40) = O.K
Static Route > Destination = 0.0.0.0 0.0.0.0> Interface = WAN1 > Distance 5 > Priority=0
Static Route > Destination = IP of Branche/32 > Interface = vlan40 > Distance 5 > Priority=3

IPSEC Tunnel to Branche = Up

Policy from LAN1 > VLAN40 = disabled
Policy from LAN1 > WAN1 = outgoing all enabled

Log > Forward Traffic > all Clients from LAN1 try to use Destination Interface VLAN40 > implicit Deny

I tried diag ip rtcache flush > no success

All clients from LAN1 use outgoing interface VLAN40 until I disable the interface

What is wrong?

4 replies

AEK
SuperUser
AEK
SuperUser
February 10, 2024

Hallo

Have you tried with policy routes:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-the-firewall-Policy-Routes/ta-p/189996

AEK
    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    February 10, 2024

    As @AEK suggests, policy routing is one way to accomplish.

     

    Another way to accomplish without policy routes is:
    1. "set defaultgw disable" on both wan1 and wan2(VLAN40) interface config

    2. set a simple static default route to wan1 and another static default route with higher priority number (lower priority) like 10 to wan2:
    config router static

      edit 0

        set device wan1
        set dynamic-gateway enable

      next

      edit 0
        set device VLAN40

        set dynamic-gateway enable

        set priority 10

      next

    end
    At this point, all HQ users internet should go out to wan1 if the default policy exists

    3. set up your IPsec VPN to branch by specifying wan2(VLAN40)

    4. set more specific routes for branch office's subnets toward the tunnel interface

    5. Then set up proper policies for traffic to branch(es)

    And, the third option is to set up SD-WAN and build up rules to route sperifically. This is more advanced/controllable policy routing.

     

    In other words:
    option1 - good old "FW" guy's way

    option2 - good old "Router" guy's way

    option3 - newer "SD-WAN" guy's way

    Toshi

      AEK
      SuperUser
      AEK
      SuperUser
      February 10, 2024

      @Toshi_Esumi , so I'm the good old FW guy? :D

      AEK
        Toshi_Esumi
        SuperUser
        Toshi_Esumi
        SuperUser
        February 10, 2024

        Then, I'm a good old router guy, of course. ;)

        Toshi

          kxs
          kxsAuthor
          New Member
          February 11, 2024

          good old "Router" guy's way is not working for me.

          can not establish a tunnel. Only if distance the same.

          Toshi_Esumi
          SuperUser
          Toshi_Esumi
          SuperUser
          February 11, 2024

          What do you have in the routing-table at the beginning? Below is my SD-WAN 40F's.

           

          fg40f-utm (root) # get router info routing-t all
          Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
          O - OSPF, IA - OSPF inter area
          N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
          E1 - OSPF external type 1, E2 - OSPF external type 2
          i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
          * - candidate default

          Routing table for VRF=0
          S* 0.0.0.0/0 [1/0] via x.x.x.x, ppp3, [1/20]
                              [1/0] via y.y.y.y, a, [1/1]
          <snip>

           

          If it's a dynamic IP on wan2, you might need to set a DDNS and use the DNS name on the branch side as static/main mode IPsec to connect to wan2.

          Toshi

            Terms & ConditionsAccessibility statement