Skip to main content
parsaz
parsaz
New Member
November 5, 2017
Solved

Internal Network Internet Access Problem

  • November 5, 2017
  • 1 reply
  • 3566 views

Hi 

 

I have a strange problem which I could not understand what exactly cause this issue I have a Fortinet 90D Firewall and I have 2 ISP connections for redundancy ISP 1 is connected to WAN1 and ISP 2 is connected to Internal Port 14 I have done all the static routes and Policies settings right but here is still a problem, in the internal VLAN I have 3 servers:

 

server 1 and 3 have access to internet through WAN1 but not through Internal port 14

server 2 has access to internet through Internal Port 14 but not through WAN1 

 

All the settings for all servers have been done the same can you please help me how I can fix this issue to give access to all the servers through both interfaces. 

    Best answer by ede_pfau

    hi,

     

    and welcome to the forums.

     

    It seems you are using 2 default routes with the same distance and priority, one for wan1 and one for port14. The FGT will now send traffic from even source addresses through one WAN port and that from odd source addresses through the other. This is called ECMP (equal cost, multiple paths).

     

    If you only want to set up port14 as a backup link (and not for load sharing) then increase the route priority for the secondary default route. You can only do this in the CLI:

    config route static

       edit 2

          set priority 200

       next

    end You may need to adapt your actual setup like the route #. Keep the distance parameter equal to be able to see both routes in the Routing Monitor.

    1 reply

    ede_pfau
    SuperUser
    ede_pfauAnswer
    SuperUser
    November 5, 2017

    hi,

     

    and welcome to the forums.

     

    It seems you are using 2 default routes with the same distance and priority, one for wan1 and one for port14. The FGT will now send traffic from even source addresses through one WAN port and that from odd source addresses through the other. This is called ECMP (equal cost, multiple paths).

     

    If you only want to set up port14 as a backup link (and not for load sharing) then increase the route priority for the secondary default route. You can only do this in the CLI:

    config route static

       edit 2

          set priority 200

       next

    end You may need to adapt your actual setup like the route #. Keep the distance parameter equal to be able to see both routes in the Routing Monitor.

    Fullmoon
    Fullmoon
    New Member
    November 6, 2017

    this link shed you more info regarding what you are aiming for.

    http://kb.fortinet.com/kb....do?externalId=FD32103

    Terms & ConditionsAccessibility statement