Skip to main content
ManUnderConstruction
ManUnderConstruction
Explorer
October 1, 2024
Question

Need assistance - dual WAN

  • October 1, 2024
  • 2 replies
  • 1031 views

Hi,

Good day everyone.
I would like to seek your assistance as networking is the least of my professional skills :(

Currently, I need to transition the current Internet Line from existing different ISP to another one for one of our remote office but at the same time, let the other old Internet Connectivity up for the time-being.

The old Internet Line (A) is connected to WAN1 of the firewall, and has existing site to site VPN.
The new Internet Line (B) is connected to WAN2 of the firewall. The Internet Line (B) connection has it's own router and the PublicIP is NAT'ed to 192.168.1.2 - connected to WAN2 which now has 192.168.1.3 IP.

My question is, what is the best approach for this? I would like to set-up WAN2 (Line B) as the main line and also set-up site-to-site VPN but at the same time, retain the existing line A as the backup temporarily in case for 2 months before totally discontinuing it if all works well. ...

How can I do this? 

Thank you!!! 

FortiGate 


2 replies

Jackie_T
Staff & Editor
Jackie_T
Staff & Editor
October 1, 2024

Hi,

For simple setup, you can achieve this by configure ECMP routes.
Mean both WAN1 and WAN2 will have same distance value set, but WAN1 will have higher priority value set.
The link with higher priority value will be less preferred and stay as standby link.
If you need redundancy for VPN as well, you can configure monitor VPN2 for the VPN configured under WAN1.
In case VPN2 under WAN2 failed, then WAN1 VPN1 will come up.

Reference document:
For Dual WAN:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Redundant-Internet-connection-without-load/ta-p/197694

For VPN:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPsec-VPN-Site-to-Site-tunnel-monitor/ta-p/190643

 

Thanks.

sw2090
SuperUser
sw2090
SuperUser
October 1, 2024

annother solution would be to use sdwan. Add both WAN to the default Zone and maybe create an sdwan rule to maintain which wan to use when - or use the implicite loadbalancing rule.

Attach some health check probably.

Then use the sdwan interface instead of wan1/wan2 in your policies. 

And have one default route pointing to sdwan.

SDWAN will do the rest for you. It will detect if one wan is not available and take it out of service and also bring it back in once it becomes available again.

Might just be a bunch of work to change all policies. Maybe goes the fastest if you pull a unencrypted backup from your FGT and edit that and do a search and replace and the sdwan config and then restore it.

Terms & ConditionsAccessibility statement