SD-WAN Can't use Ip pool

Hi Vincent,

You have to assign the IP Pool to the interface with these CLI commands:

config firewall ippool

edit "IPPool name"

set associated-interface wan1

next

end

But, you have to force the trafic to the right interface in SD-WAN rules. In the current version, we can't assign IPPool on one interface and use outgoing IP address on the other. Feature Request have been asked for this.

If you want to use SD-WAN with IPPool, you have assign IP Pool on both wan interfaces, and don't forget to associate IPPool with the right one! :)

Issue you currently have is weird: Fortigate tries to NAT on interface WAN2 with the IP Pool of the WAN1!

Let me know if it fixes your issue! 

Philippe Gagné, NSE7

Androide

I have similar problem to you. Each office room of my company use different Public IP. When our main ISP is at fault, only the interface IP can switchover, I have to manually change to use backup ISP.

As I know, you have to use Interface IP as NAT source. Fortinet hasn't resolve this problem. It's boring. 

Vincent.Lai wrote:

Hello 

 

I have a Fortigate 200E FortiOS v6.0.4 build0231 (GA)

 

I have two ISP with SD-WAN  and each ISP has an ip pool

 

But if the intranet has an IP that wants to go out with a specific IP of the IP pool

 

When I configure IPv4 Policy like this and use "use dynamic ip pool", the IP can't access the Internet.

I'm running 7.0.5 and I don't have an option for "set associated-interface" on an IP pool.

I have two ISPs. They are for failover only. For a few scenarios, I need outbound traffic to be tied to a specific IP for each ISP. I created two IP Pools - one for each ISP and created Firewall Policies that use them but when the router fails over to the secondary connection, it continues to try to send traffic out using the highest-priority Firewall rule. I assume associating an IP Pool with an interface would fix this because the Fortigate would ignore rules applied to a down interface? So my secondary rule for my failover ISP would work correctly?

If there is a feature request to fix this, please link it so I can follow it. If there's a current workaround, let me know. I think I could ditch SD-WAN and use health monitors to manage my setup but SD-WAN has some nicer line monitoring features so I'd prefer to keep it.

Hey Scott,

I have a FortiGate 7.0.5, and I can set associated interfaces in IP pools, though only via CLI:

-> port1 is also a member of an SD-WAN zone (not operational - just to verify that this works)

-> I created the SD-WAN zone first, THEN created IP pool via CLI

Thanks for taking the time to test this out!

So I dug a little deeper and turns out my IP Pool was for a One-To-One NAT. I changed it to Overload and I was then able to associate an interface. I also verified the behavior by unplugging WAN1 and sure enough, my IP Pool traffic was going out on WAN2's specified IP from the IP Pool.

Since my firewall rule only includes one IP address, overload should effectively work the same as 1:1 NAT, it's just semantics i guess...

Is there a reason to not allow interface association for 1:1 nat?