Skip to main content
flybelgium
flybelgium
New Member
August 27, 2018
Question

LAN users to WAN1 and Wifi to WAN2

  • August 27, 2018
  • 4 replies
  • 15741 views

Hello,

 

I have a Fortigate 100E and i would like to route internet traffic to 2 differents WAN. Actually, i have made this configuration and... not working :

1. In interfaces, i have my 2 WANS configured with the ISP ip config

2. In Static Routes, i have my 2 WANS configured with the gateway of my ISP. First with distance 10 and WAN 2 with distance 20.

3. In IPV4 Policy i have basicaly 2 policies :

--> 1 All LAN traffic to WAN1 source all - destination all with AV, Web Filter and AppControl and SSL Inspection.

--> 2 LAN Traffic with in source 2 Locales IP only 192.168.100.10 + 192.168.100.11> destination All to WAN 2

At this point all the traffic go to WAN1...

I have made a policy to DENY 192.168.100.10 and 192.168.100.11 to WAN1

At this point, this two ips are not working... no WAN traffic, in traceroute i dont have any responses, local network ok, no outgoing traffic to WAN2 or WAN1.

 

Important, WAN1 traffic go to CISCO Router and WAN2 Traffic is a cable modem in bridged mode. I just would like to route selected IP to WAN2 and the rest to WAN1, like servers to wan1 and users to wan2. Any idea ?

Thanks in advance.

    4 replies

    tanr
    tanr
    New Member
    August 27, 2018

    Your static routes need to have the same distances, but different priorities, that way they will both stay in the routing table, but the route with the higher priority (lower number) will be used by default.

     

    So, say you have created the route to WAN1 with the higher priority.

    Create a policy route with, your WiFi users as the source, and specify WAN2 as the outgoing interface. 

    The policy route will find the other route in your routing table and use it.

    flybelgium
    flybelgiumAuthor
    New Member
    August 27, 2018

    tanr wrote:

    Your static routes need to have the same distances, but different priorities, that way they will both stay in the routing table, but the route with the higher priority (lower number) will be used by default.

     

    So, say you have created the route to WAN1 with the higher priority.

    Create a policy route with, your WiFi users as the source, and specify WAN2 as the outgoing interface. 

    The policy route will find the other route in your routing table and use it.

    Thanks tanr.

    In my tests, i have deleted my static route to WAN2 and now, i cannot add a static route...

    Destination 0.0.0.0/0.0.0.0 Gateway = ISP Gateway of WAN2 (for example 2.2.2.2) Interface WAN2 Administrative Distance = 10 Priority = 10

    I have this error :

    Error

    A duplicate entry already exists.

    I just have only one static route to WAN1

    Destination 0.0.0.0/0.0.0.0 Gateway = ISP Gateway (1.1.1.1) Interface WAN1 Administrative Distance = 10 Priority = 5

    If i look to routing monitor, i see a connected route to my WAN2... i dont find where is this connected route ?

    Thanks in advance

    flybelgium
    flybelgiumAuthor
    New Member
    August 28, 2018

    I have found my error, it was on IP POOL, i have made a ip config for testing purpose in this menu... deleted and ok.

    At this time, i have added a second static route with ISP Gateway WAN 1

    Destination 0.0.0.0/0.0.0.0 Gateway = ISP Gateway of WAN1 (for example 1.1.1.1) Interface WAN2 Administrative Distance = 10 Priority = 10

    WAN 2

    Destination 0.0.0.0/0.0.0.0 Gateway = ISP Gateway of WAN2 (for example 2.2.2.2) Interface WAN2 Administrative Distance = 10 Priority = 5

     

    I have made a policy for just my ip go to WAN2 for testing...

    Not to bad... when i made traceroute, i can see my WAN2 after the fortigate but... all users on LAN interface

    doesnt have WAN access to WAN1... strange... i think LAN users go through WAN2...  This is "not possible"... i dont have any rules to forward internet traffic to WAN2, only my rule with my ip :

    Incoming : LAN interface

    Outgoing : WAN2

    Source : My Ip created in Adresses (my ip is in the lan interface range)

    Destination : All

    Service : All

    and NAT activated.

     

    I dont understand... Thanks in advance for help.

     

     

    fslomka
    fslomka
    New Member
    September 3, 2018

    What about using the SD-WAN feature?

    Give WAN1 a priority of 254 and WAN2 a priority of 1

    Then create a custom rule to pass certain traffic(ips) through WAN2

    pawanrohilla1984
    pawanrohilla1984
    New Member
    October 12, 2018

    hi is it working now?

     

    sw2090
    SuperUser
    sw2090
    SuperUser
    October 15, 2018

    Basically:

     

    if you set your policies in the order you wrote them down here all traffic will alwys match the first and go to wan1. The second in this case will never ever match since policies are always exempt in fortios.

     

    (2) must be the first policy to match those two ip.

    (1) comes behind that and matches the rest of the subnet.

    Terms & ConditionsAccessibility statement