Skip to main content
caramelmeimei
caramelmeimei
Visitor III
April 19, 2023
Solved

Load balance 2 WAN provider using each available IP block

  • April 19, 2023
  • 4 replies
  • 6499 views

We have a current SD WAN setup with LAN internet connectivity traffics load balanced to 2 ISP providers - both WAN interface IPs are used and the bandwidths are combined.

  • 192.168.0.0/24 --> ISP-A-50Mb (1.1.1.1/29) + ISP-B-50Mb (2.2.2.1/29)
    1. Both IPs are used randomly in each session even in a single device
    2. Bandwidths are combined to 100Mbps

This time I would like to use the other available IPs from each ISP block then still have the bandwidth combined and load balance from a diff LAN subnet.

  • 192.168.10.0/24 --> ISP-A-50Mb (1.1.1.2/29) + ISP-B-50Mb (2.2.2.2/29)

Attempt: Assign overload IP pool for each ISP, and setup an outbound firewall policy NAT to it.

  1. Only single IP (random) is used per device
  2. Only single ISP bandwidth is utilized - 50Mbps
    Best answer by gfleming

    OK today I learned that fast.com uses multiple sesssions and servers to conduct a speed test. This makes sense why it would be combined across both wan links then!

     

    So currently you have one FW policy that works and you have another FW policy referencing a different LAN subnet and using different IP pools that does not work in terms of load balancing? Is that correct?

     

    Have you tried splitting the FW policies for the different LAN subnet for each ISP/pool?

    4 replies

    knagaraju
    Staff
    knagaraju
    Staff
    April 19, 2023

    Hello caramelmeimei,

    In the case of a dynamic IP pool, your requirement cannot be achieved and it is by design.

    Please refer the below link for additional details on it
    https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-SNAT-with-IP-pool/ta-p/195322


    gfleming
    Staff
    gfleming
    Staff
    April 19, 2023

    Can you explain your use-case here? What are the requirements that are dictating the configuration you are looking for?


    IMO just using SD-WAN with load-balance algorithm should work fine. Why do you need such complexity?

    caramelmeimei
    caramelmeimeiAuthor
    Visitor III
    April 20, 2023

    I have a group of users that need to use a diff set of public IPs ( ISP-A-50Mb (1.1.1.2/29) + ISP-B-50Mb (2.2.2.2/29) ) in accessing the internet ,instead of the IPs in the interface ( ISP-A-50Mb (1.1.1.1/29) + ISP-B-50Mb (2.2.2.1/29) )

    gfleming
    Staff
    gfleming
    Staff
    April 20, 2023

    OK I haven't tested this in lab but I think it should work:

     

    Two SD-WAN rules:

    1. Source Group A -> Load Balance on WAN1 and WAN2

    2. Source Group B -> Load Balance on WAN1 and WAN2

     

    Two FW Policies:

    1. Source Group A -> Dest All -> NAT Pool containing 1.1.1.1 and 2.2.2.1

    2. Source Group B -> Dest All -> NAT Pool containing 1.1.1.2 and 2.2.2.2

     

    Something like that?

    gfleming
    Staff
    gfleming
    Staff
    April 21, 2023

    What version of FOS are you on?


    Do you have any rules or services in your SDWAN config? Is there more under your 'config system sdwan' configuration?

     

    Can you try changing the LB method to "source-dest-ip-based"?

     

    Can you further explain the behaviour you are seeing with regards to LAN users using only single IP (random) per device? How is it random? Based on your config they should only be getting one IP from the pool that is linked to that ISP.

     

    Next thing we could try is splitting the FW policy into two. One for upg-zone-wan1 and one for upg-zone-wan2 with associated pools, etc.

     

    caramelmeimei
    caramelmeimeiAuthor
    Visitor III
    April 24, 2023

    With the current setup:

    • 192.168.0.0/24 --> ISP-A-50Mb (1.1.1.1/29) + ISP-B-50Mb (2.2.2.1/29)
      1. Both IPs are used
        • In a single device, when check for public IP : for instance, ipchicken see 1.1.1.1 and ipcow see 2.2.2.1
      2. Bandwidths are combined to 100Mbps
        • When speedtest

    This is the target behavior I am expecting.

     

    However after setting FW policy with NAT IP Pools, below are the results:

    • 192.168.10.0/24 --> ISP-A-50Mb (1.1.1.2/29) + ISP-B-50Mb (2.2.2.2/29)
      1. Only single IP (random) is used per device
        • In a single device, when check for public IP, regardless of how many iplocation sites I use, it only gets 1.1.1.2. Random like, another device is only 2.2.2.2.
      2. Only single ISP bandwidth is utilized - 50Mbs
        • When speedtest

     

    Having said those, I believe "changing the LB method to source-dest-ip-based"  & "splitting the FW policy into two" - please correct me if I'm wrong, wont meet the load balancing I need base on the current setup.

     

    I am in v7.2.3

     

    The reset of sdwan config are the ff:

    config health-check
    edit "ISP1_GW_PERF"
    set server "1.1.1.254"
    set members 1
    config sla
    edit 1
    set latency-threshold 50
    set jitter-threshold 50
    set packetloss-threshold 10
    next
    end
    next
    edit "ISP2_GW_PERF"
    set server "2.2.2.254"
    set members 2
    config sla
    edit 1
    set latency-threshold 50
    set jitter-threshold 50
    set packetloss-threshold 10
    next
    end
    next
    end
    config service
    edit 1
    set name "ISP1_ISP2_WAN"
    set mode load-balance
    set dst "all"
    set src "all"
    config sla
    edit "ISP1_GW_PERF"
    set id 1
    next
    edit "ISP2_GW_PERF"
    set id 1
    next
    end
    set priority-members 1 2
    next
    end

    gfleming
    Staff
    gfleming
    Staff
    April 24, 2023
    >>>I believe "changing the LB method to source-dest-ip-based"  & "splitting the FW policy into two" - please correct me if I'm wrong, wont meet the load balancing I need base on the current setup.
    Load Balancing is a function of the SD-WAN rule and has nothing to do with the FW policies allowing the traffic. So splitting your FW policies into two will not affect your load balancing (assuming they allow the traffic).
    Also, source-dest-ip based load balancing method means each connection will be evaluated based on the source and destination to determine the hash and decision making criteria to load balance it onto a specific link. Therefore source client A going to dest A will load balance on to ISP1 and source A dest B will go to ISP2. It really helps ensure the good sharing between ISP links but also maintains stability on the client level. i.e. some websites will break if they source IP keeps changing on them.
     
    Please clarify something for me though: the load balancing is only done on a session-by-session basis. So there is no way a client will see 100mbps on speed test when you are load balancing between two 50mbps links. The behaviour you are describing in scenario 1 does not make sense. In fact the behavriour you are describing in the second scenario makes more sense. Things are being load balanced (one client gets a 1.1.1.2 address and another gets a 2.2.2.2 address. Perfect! And 50mbps on a speedtest is all you'll see on a single client.
     
    What do you see in the SD-WAN Zones configuration on your FGT in terms of bw utilization on each link?
    You can also add an interface bandwidth usage graph for each ISP link onto your Dashboard.
    gfleming
    Staff
    gflemingAnswer
    Staff
    April 26, 2023

    OK today I learned that fast.com uses multiple sesssions and servers to conduct a speed test. This makes sense why it would be combined across both wan links then!

     

    So currently you have one FW policy that works and you have another FW policy referencing a different LAN subnet and using different IP pools that does not work in terms of load balancing? Is that correct?

     

    Have you tried splitting the FW policies for the different LAN subnet for each ISP/pool?

      caramelmeimei
      caramelmeimeiAuthor
      Visitor III
      April 27, 2023

      Great! Splitting policies did it. Both IPs being used and bandwidth on speedtest are combined now. Thank you very much Graham.

      Terms & ConditionsAccessibility statement