This is a surprisingly complex topic. Here's a KB article I put together for our internal staff on the subject that explains this from a conceptual standpoint:
Setting up fortinet Fortigate firewalls for dual wan scenarios with >=2 Internet Connections
General strategy for setup:
Static default route for each wan interface[/ol][ul]same distance for each routedifferent priority for each route (lower priority wins)[/ul]
[ul]2. Link health monitor for each route. [ul]
This is what allows the route to be removed from the routing table if the link is unusable. This route gets removed from routing table if the IP's given here aren't reachable.[/ul][/ul]
3. Policy Route for traffic that should use the secondary interface (the one Higher priority)
[ul]MUST leave default gateway as 0.0.0.0This allows it to be removed if that interface goes down.[/ul]
Routes specify where to send traffic.
This will generally be an interface (wan1, wan2, lan, etc) or a VPN tunnel to a remote site.
the VPN appears as a virtual interface just like an internet connection.
Routing Notes:
Each Policy route is inspected. As soon as one matches it wins and traffic goes that wayIf a policy route refers to an interface that is down (via the link health monitor) then it will be skipped.[/ol]If no policy route matches, then inspect each Static route, going from the lowest priority up.as soon as traffic matches, it goes that way.[/ol][/ol]
Note: If you need certain traffic to skip the priority routes, (for example forcing certain IP's to use the primary route even though there's a policy route to send that subnet via the secondary route), you can put an entry HIGHER in the list of policy routes for the IP(s) that stays "stop policy routing"
Policies specify what is done to the traffic as it passes this interfaceCheck if traffic is allowed to passby Source address, dest address, or port[/ol]What inspection should be done on that traffic AV, Website Blocking[/ol]NAT of the source IP address (sNAT)Changing the private 10.x.x.x address to a public IP address.[/ol][/ol][/ol]
DIRECTION of traffic from the fortigate's perspective is important to understand:
In general, keep in mind that with the FortiGate we are always thinking of traffic in terms of where the traffic first originated (ie which machine asked for the traffic).
When an end user is watching a youtube video, that is controlled by a policy from LAN to WAN.the fortigate catches the outbound request for the traffic from the user and automatically associates all the inbound traffic from wan to lan with that original session.No settings are needed for WAN to LAN for this traffic, even though most of the traffic is flowing from the Internet to the user, it is considered LAN to WAN traffic.Note this uses the sNAT indicated in the WAN to LAN policy to change the source address of the traffic to appear to be coming from a public adress. the IP Pool selected in the policy does this[/ol][/ol][/ol]
When someone on the Internet connect to the exchange server, this is controlled by a policy from WAN to LAN.The fortigate catches the inbound request from WAN to LAN and automatically allows returning traffic from the server back to the itnernet client.Even though most of the traffic will be going from the email server (LAN) to the client (WAN), this is considered a WAN to LAN flow, since it was initiated on the WAN.In this case, the DESTINATION IP is changed ( the public IP used by the client on the itnternet is mapped to the private IP of the email server using a Virtual IP.)this is controlled by the VIrtual IP.[/ol][/ol][/ol]
Servers that also initiate traffic to the internet and need to use a specific public IP address (Like email servers sending SMTP messages out) also need to be set up like clients, so they will also have their own LAN to WAN policy rule with a dedicated IP address (Using a IP Pool).[/ol]
