How do I configure multiple VLANs to access different WAN links?

Question

Hi Support,I am New to Fortinet firewall. we are using FortiGate 100F firewall and the firmware version is v7.4. we have created multiple Vlans and two WAN links. now I configured static route for wan links. and Now all the vlans network traffics are going in only one wan link ie (primary Link). the secondary wan link is idle. so i need to segregate  the Vlan traffic with the two WAN link. i need to configure One Vlan to access only Primary wan link. and second Vlan to access  secondary wan link.  and i have not configure the wan link in SD wan ZONE can you Please help.

srajeswaran · Accepted Answer

Can you enable ECMP for routes via WAN links and check? Make sure the routes via WAN1 and WAN2 are configured with same priority/distance.

# config system settings

set v4-ecmp-mode source-dest-ip-based

Ref: https://community.fortinet.com/t5/FortiGate/Technical-Tip-ECMP-Load-balancing-algorithms-for-IPv4-and-IPv6/ta-p/191149

xsilver_FTNT · Answer

Hi,

if I got it correctly then you need to have several VLANs. You do have 2 WAN link connections. And you need to route traffic from specific VLAN to specific WAN link.
If that's the case, then I do see following options (from less to most config intensive):

1. Policy routes

- simply use that for a source IP Address + Incoming interface being your VLAN, and Outgoing interface option enabled and respective outgoing interface set.
- Via GUI in Network/Policy Routes , in CLI via 'config router policy' (simplified example):

config router policy
edit 0
set input-device "WLAN-11"
set src "10.0.11.0/255.255.255.0"
set dstaddr "all"
set output-device "WAN-2"
next
end

2. VRF

- separate interfaces by VRF ID and use that for routing between them
- more can be found in: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/224629/virtual-routing-and-forwarding

3. SD-WAN

- use Software Defined WAN and policy based routing to have more complicated setup, however with benefits like link quality monitors and overflows between WAN interfaces if needed

- more on that in: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/19246/sd-wan

Sign up

Login with SSO

Login to the community

Login with SSO