Skip to main content
dzajac
dzajac
New Member
May 24, 2020
Question

Same Portforwarding over 2 WANs

  • May 24, 2020
  • 2 replies
  • 2672 views

I am using a Fortigate in NAT mode.

The firewall has two WAN (1x Fibre, 1xVDSL).

 

Both connections are working and now I want to have incoming NAT on both WANs to the same Server.

Routing is configured with both static routes with the same priority and same distance.

 

The rules are working. But only one at a time. If both are enabled, only one is working. If I disable one rule the other works o.k.

But if both are enabled, the traffic always seems to be answered over the VDSL not the incomming interface. So the Firbre NAT stops working as soon as both rules are enabled.

 

The NAT on the Fibre line is using and additional IP not the WAN on that interface.

 

Policy routing is not enabled yet.

 

Goal is to have the server answering on the same interface for the two NAT rules, that was used inbound.

 

    2 replies

    lobstercreed
    lobstercreed
    New Member
    May 24, 2020

    Please provide more detail regarding your policy config.  It sounds like you have two different VIP objects with two different policies (since you mention enabling one and then the other?).  If you've setup a zone (or SD-WAN) for your two Internet connections, you could have them on one policy, but that shouldn't make any difference. 

     

    It sounds to me like it should work the way you're describing as long as it passes RPF check (and it sounds like it would since you said both static routes have the same priority and distance).  I wonder if you have something goofy in your VIP config, so maybe show that config as well please.  Feel free to obfuscate IPs as long as it is clear what goes where.

    maredcz
    maredcz
    New Member
    May 25, 2020

    I had similar issue with 6.2.3 on FG60E. The back route was not cached and response was routed depending on routing table. So if the wan1 has the route with higher priority, the request coming to wan2 is forwarded to vip destination, and the response is going thru wan1. This behaviour was active when in system settings was asymroute enabled or the new 6.2.3 feature "auxiliary-session" enabled. The asymroute feature deactivates the reverse path route caching.

    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!