Routing for two different gateway

In transparent mode Fortigate will just pass traffic from one port to another port (like a bridge), it will not route it. IP address on the Fortigate in transparent mode is just for Management. If you want to do policy based routing you will need to be in NAT/Route mode. You change operating mode of the FG on Dashboard, System information. Make sure you backup the configuration of the FG before changing the operating mode. Depending on your setup you can migrate from transparent to NAT mode like this. Assign IP addresses to WAN1 and WAN2 of FG based on your ISP addresses. Assign private ip address for your server. Define Virtual IP for WAN1 and WAN2 pointing to your internal ip of server. Define 2 default routes and necessary firewall policies to allow traffic. Define the policy based routes on the FG.

As rocampo wrote, the Fortigate does not route at all in transparent mode. There is nothing special if your servers are configured with different gateways and IP' s. You can put the Fortigate into routing mode and lead the traffic via Virtual IPs to the servers but what for? Leave it as it is and you' re fine IMHO.

In transparent mode, think of the FG as a wire. Well, a wire is a layer 1 device and a transparent bridge is a layer 2 device - it will buffer packets, regenerate them if necessary, adjust link speed etc. but will not influence layer 3, routing. This is done on your servers. As you already have more than 1 public IP you could test this with a second IP and a second server. BTW, do you feel confident to have your servers directly connected to the Internet?

I@ede_pfau: f you have the fortigate in transparent mode between the servers and the internet and you do IPS/AV/and firewalling on the transparent fortigate.. do you see a problem there? Of ycourse you can imagine a scenario with someone bridging around the fortigate. I would also agree that, when you have to access the servers from internal it is probably more elegenant to access a RFC IP. But i do not see a general problem with a transparent fortigate infront of internet servers. (But that is not really relevant to the thread starter). If starting new i' d probably go with nat/vips and ecmp, but i think it should do they way it is setup now.

Hi Jan, in the transparent scenario, the servers have to deal with all connection attempts from the internet. My feeling is that a Fortigate can deal better with DoS attacks. Who cares if the firewall is running hot as long as the servers can deliver their content? And think of all the security holes in a general purpose OS. There are so many services running that it means a lot of work to secure them all. MS keeps discovering holes all the time. And not only the OS is exposed but the applications also (IIS, apache,...). I hope that at least they do their remote management not via RDP directly (but use the transparent mode IPSec VPN of the FG). Right, yongsan?

If you have a transparent firewall in front of the servers with proper policys in place the exposure of applications is only on the allowed ports.And this ports/aplications are also exposed if the server is in a dmz with nat and policies. If there is a permit any any policy in the transparent fgt you are right..

You ca try using VDOMs, one vdom in transparent mode doing what the FG is doing right now, the other in NAT mode, for the new settings.

Hi, Thanks for all your feedbacks. I guess the best and most elegant way is to revert to NAT mode and do routing policy. The previous system administrator set it up as transparent mode and closing all the ports not used by the server. YongSan