Skip to main content
rharland
rharland
New Member
May 31, 2018
Question

Multi-WAN with Virtual IPs tied to public IP on one link only?

  • May 31, 2018
  • 1 reply
  • 4285 views

We're lighting up a second ISP connection on one of our 200Ds. Currently, we have a few virtual IPs configured on the firewall for public services, and these are tied to one provider as one might expect.

 

As I read multi-WAN instructions, I'll need to nuke all policies and routes to the separate ISP connections, create the load-balanced entity, and rebuild policies and routes accordingly. Fairly straightforward. 

 

What I'm having trouble discovering is how I can make these virtual IPs still work for external-facing services. Do I need to simply redefine the virtual IPs with a different interface mapping (in other words, from WAN1 to WAN_loadbalance) and leave everything else the same, or are there additional steps that need to be taken?

 

Thanks for any info.

    1 reply

    ericli_FTNT
    Staff
    ericli_FTNT
    Staff
    May 31, 2018

    Hi, can you provide an example so that I could give you a config sample. Thanks!

    rharland
    rharlandAuthor
    New Member
    May 31, 2018

    Sure!

     

     

    So let's say we've had ISP1 as the sole provider up until now. From this provider, we get some public IP addresses. We'll call these addresses 4.4.4.0/29 or something like that. We have a public-facing server that uses 4.4.4.4 on the public side, and has an internal address of 10.100.100.4. So, for outside-in traffic, we configure an appropriate rule and build a virtual IP that maps 10.100.100.4 to 4.4.4.4, and configure that virtual IP to use ISP1 on WAN1, and for egress traffic sourced from the server we build an IP pool that references that same IP address. Fair enough.

     

    Now, we get a second provider - ISP2 - and we decide we'd like to do multi-WAN loadbalancing. Based on the docs, I know I'll need to 1) remove any routes pointing to either the WAN1 or WAN2 interfaces and b) remove any policies that point to either interface - since I can't build the multi-WAN entity in the config if either interface is referenced explicitly, and building that virtual multi-wan interface is the first step in the process.

     

    So, with that said, can I implement multi-WAN and still use virtual IPs/IP pools that are specifically tied to a single provider? I don't want to lose that functionality. My guess is that I could amend the virtual IP entry to point to 'any' interface instead of the separate WAN interfaces, but I don't know that to be true as of yet.

     

    Hope this helps, and thanks for the response.

    ericli_FTNT
    Staff
    ericli_FTNT
    Staff
    May 31, 2018

    Got your point. I will switch to this as my very next task. Get back to you soon.

    Terms & ConditionsAccessibility statement