Skip to main content
Matthew_luke
Matthew_luke
New Member
April 8, 2018
Question

Fortigate 100E Multiple WAN Connection

  • April 8, 2018
  • 1 reply
  • 7724 views
Does Fortigate 100E have stateful connection for mutilple WAN connection? For my case, I have setup a server network which connected to two internet service provided by ISP A and ISP B though Fortigate 100E. When there is client access the server from ISP A, the server should able to return the traffic using WAN port which connected to ISP A, and When there is client access the server from ISP B, the server should able to return the traffic using WAN port which connected to ISP B, Can Fortigate Firewall able to support according to my requirement?

    1 reply

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    April 8, 2018

    hi,

     

    and welcome to the forums.

    Yes, the VIP/destination NAT which you use to publish your internal servers is stateful. Even if not, FortiOS would always try to lead return traffic back to the port it came in.

    You need to have appropriate routes (that is, 2 equal default routes) in place, and of course policies allowing the traffic in.

    Matthew_luke
    Matthew_lukeAuthor
    New Member
    April 8, 2018
    Hi Since the destination NAT for server on ISP B will not configured on the Fortigate FW (will be configured on other FW which is installed in front of Fortigate FW), the destination NAT for server will only configured on Fortigate FW for ISP A, does default route with equal cost can achieve my requirment? Do I need to implement the FortiADC with reverse path route cache in order to achieve my requirment or Fortigate 100E include the reverse path route cache by default without FortiADC? Thanks
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    April 9, 2018

    Incoming traffic (NATted or not) will create a session if allowed. Part of the session state is the ingress port. FortiOS will try to send return traffic via the same (ingress) port.

    So far the theory. As I have not got a dual-WAN setup at the moment I cannot confirm this. You will need two default routes in any case, with equal distances, otherwise ingress traffic may be dropped.

     

    Maybe other forum members could comment on this, as seen in practice.

    Terms & ConditionsAccessibility statement