Skip to main content
Vurdalag
Vurdalag
New Member
August 28, 2023
Solved

Fortigate Route Trafic from Specific Interface to Specific WAN

  • August 28, 2023
  • 10 replies
  • 17030 views

Hi, I have Fortigate 60F and two ISP added to SD-WAN:

WAN1

WAN2

 

 

I would like always to route traffic from Interface "3" (Subnet 192.168.0.0/24) to ISP "WAN2" and never failover to ISP "WAN1". If "WAN2" is down then clients on Interface "3" will be offline (that is OK). When other interfaces can use WAN2 as primary ISP and failover to WAN1 ISP. 

If I will create below SD-WAN RULE then won't Interface "3" (192.168.0.0/24) failover to WAN1 in case of WAN2 is offline?

SD-WAN RuleSD-WAN Rule

 

Best answer by Vurdalag

For the time being found three options how to block traffic originated from subnet 192.168.0.0 (port3) to be routed via WAN1 port even if WAN2 is physically down (cable unplugged):

 

1) Found on this resource absolutely the same issue what I have:

https://www.reddit.com/r/fortinet/comments/p7j1zl/restrict_certain_subnetinterface_from_using/

 

On port3 (subnet 192.168.0.0), I created secondray IP 100.64.0.1/24

Secondary IP addressSecondary IP address

 

Created two policy routes. First routing policy is to route always traffic from 192.168.0.0/24 subnet (port3) via WAN2 (Starlink):

Policy Route Nr. 1Policy Route Nr. 1

 

Second policy to route traffic from port3 to port3 with gateway as this port's secondary IP which is 100.64.0.1. Once WAN2 link is down (cable unplugged for example) then first routing policy is skipped and below is taking care of 192.168.0.0 traffic since will match:

Policy Route Nr. 2Policy Route Nr. 2

 

2) Another option, is two remove SD-WAN zone and make WAN1 and WAN2 as the separate interfaces. 

Configure failover between WAN1 and WAN2 using link-monitor as per below resource:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Redundant-Internet-connection-without-load/ta-p/197694

 

Configure Policy to block traffic from 192.168.0.0 to WAN1

 

Not sure how practical is first approach but it is working without removing SD-WAN zone. Was tested and found working. 
2nd option was tested as well.

 

3) Under SD-WAN create two new zones:

WAN1 ZONE

WAN2 ZONE

 

Add WAN1 and WAN2 interfaces to respective zone. 

Create two SD-WAN rules:

- Rule1: Source Address specify subnet what you want to route via WAN2 only. Manual mode -> Interface Preference: WAN2

- Rule2: Source Address specify all remaining subnets what can access WAN2 and WAN1.  Manual mode -> Interface Preference: WAN2, WAN1 (order of interfaces is important)

Go to Routes -> Static Routes -> Add both new SD-WAN zones to Static Route Device fields

 

Configure SLA under SD-WAN

Configure Policy Firewall:

Top rule Block subnet 192.168.0.0/24 from accessing WAN1 (WAN1 ZONE as destination interface)

Second rule allow 192.168.0.0/24 subnet to access WAN2 interface (WAN2 ZONE as destination interface)

 

10 replies

joshmorrisMEG
joshmorrisMEG
Explorer
August 28, 2023

This is achievable using a Policy Route - they trump SDWAN - this is a great reference material for route lookups with proute/sdwan/traditional FIB

 

 

joshmorrisMEG_0-1693235685040.png

 

Vurdalag
VurdalagAuthor
New Member
August 30, 2023

As per documentation in order to Policy Route work we need to provide at least two parameters:
-Outbound interface

-Gateway

On WAN2 interface we have Starlink aerial. When it is offline it has Gateway 192.168.100.1 and when is online 65.181.7.1 in current region, but I assume this gateway will change based on location. 

If this GW 65.181.7.1 would be permanent then I can create two policy routes one for 192.168.100.1 gateway and another one for 65.181.7.1 and that would be enough. 

But in my case once Gateway changes it will break above policy routes and Fortigate will start looking to Routing Table which will have below route via WAN1:

S*      0.0.0.0/0 [1/0] via x.x.x.x, wan1, [10/0]

 

I tried to provide 0.0.0.0 Gateway but Fortigate is ignoring such Policy Route and look directly to Routing table. 

I can't apply Policy with restriction for traffic originated from Interface "3" to use "WAN1" connection because both WANs are in SD-WAN. 

What option do I have here? If I exclude WAN1 and WAN2 from SD-WAN then will I be able to achive below via Static Routes and Policies?:
- default route for all internal interfaces via WAN2 (Starlink)
- in case WAN2 is down, failover to WAN1 for all internal interfaces except "3"
- policy restriction for traffic originated from interface "3" to "WAN1"

xsilver_FTNT
Staff
xsilver_FTNT
Staff
August 28, 2023

Hi,

Manual selection Rule, with the only one preferred interface and no other criteria and interfaces, should do the trick.

More on that: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/723448/manual-strategy 

 

    Vurdalag
    VurdalagAuthor
    New Member
    August 30, 2023

    tried this and it still looking to Routing table and use WAN1 interface when WAN2 is down. 

    kvimaladevi
    Staff
    kvimaladevi
    Staff
    August 31, 2023

    Hi @Vurdalag,

     

    There should be a policy route to route traffic through WAN2 and another policy route to stop policy routing for that source subnet.

     

    Regards,

    Vimala

      Terms & ConditionsAccessibility statement
      Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
      Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.