Skip to main content
Troubleshooter_73
Explorer
September 9, 2015
Question

Multiple WAN Routing - Recommendations needed

  • September 9, 2015
  • 3 replies
  • 4096 views

Hi to All,

 

I need a recommendation to the Routing Topic of a fortigate 100D with 5.2.3.

Customer has three WAN Connections and some internal LANs like WLAN, Client LAN, Server LAN etc.

He will force the traffic by the following way:

Clients --> WAN1

Server --> WAN2

WLAN --> WAN3

 

I created default routes for every three connections.

I created security policies

Client Rule - Incoming Interface and Client Network to WAN1 and ALL --> works fine

Server Rule - Incoming Interface (same than Clients) and Server Network to WAN2 --> no Internet access

WLAN Rule - Incoming Interface (another than the other ones) and WLAN Network --> no Internet Access

 

Until today I assumed, if the costs and Priority are equal, I can force this by creating only the security policies for the example above, but it failed, because if I create the default routes and the security policies, only one connection is possible.

It looks like the policies were not applied for the second and third WAN connection.

If I changed the priority of the routes for testing purposes, only the connection with lowest priority works.

 

I think I understand now what the systems does, but how can I match the customer requirements, without to create hundrets of policy based routes?

 

Thanks for any advice or recommendation!

 

Sven

    3 replies

    Troubleshooter_73
    Explorer
    September 9, 2015

    Sounds like an easy job, but it doesn't work as easy as I assumed. [&:]

    I tried now recommended policy based routing, but here I have to handle about 50 Networks (IPSec and internal Networks).

    Because if I create a policy based route with 0.0.0.0/0.0.0.0 as target (its impossible to told the system take only Public networks here, like other appliances do this), all traffic will be routed to this interface. So I have to create all my Static Routes as Policy based Routes above the needed Policy based Routes for the required WAN Access. Really unlike this...

    gschmitt
    New Member
    September 10, 2015

    You can create a policy rule:

    Incoming interface (all that apply)

    source address / mask 0.0.0.0/0.0.0.0

    desination address / mask your internal networks (may need to create multiple)

    Then: Action Stop Policy Routing to fall back on your normal/default routes

    Troubleshooter_73
    Explorer
    September 15, 2015

    Here I found an entry that points me to new features:

    http://docs-legacy.fortinet.com/fos50hlp/52/index.html#page/FortiOS%25205.2%2520Help/advancedrouting.017.6.html

     

    The "negate" switch is really interesting for me, but it will be more powerful if I could combine "negate" with "multiple src-addresses". If this should work, I could decrease the configuration to only 3 Policy Based Routes!

     

    Has anybody already configured multiple source/destination subnets?

    If yes, how can I add more than one src-address in a Policy Based Route?

     

    I tried with CLI by comma separated and with space between the addresses but nothing will work.

    Or did they mean the Policy that depends on the Policy Based Route?

    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!