Skip to main content
nbctcp
nbctcp
New Member
December 17, 2019
Question

SD-WAN compatibility with Internet Banking

  • December 17, 2019
  • 2 replies
  • 6850 views

SW INFO: -FortiOS vm 6.2.2 Eval License

 

I want to know whether SD-WAN dual isp would be no problem with Internet Banking, because what I know SD-WAN only for outgoing traffic.

While Internet Banking required source and incoming ip should have same ip address.

In my theory, would be possible using SD-WAN, outgoing and incoming traffic using different isp.

 

tq

    2 replies

    sw2090
    SuperUser
    sw2090
    SuperUser
    December 17, 2019

    The NAT in the policies for internet via SD-WAN takes care for that not to happen. SD-WAN decides the WAN to use and NAT does the masquerading. The Baninkg server will replay to the external IP your connection came from and SD-WAN + NAT will take care for the replay to reach back to you.

    Anything else would result in split routig and noone - including fortinet - wants split routing ;)

    nbctcp
    nbctcpAuthor
    New Member
    December 17, 2019

    I am not clear

    Let say I have dual ISP

    Do you mean 1. all traffic in SD-WAN will always outgoing and incoming with the same ISP or 2. I need to create a policy which if destination category Internet Banking then choose ISP1

    Do you have reference url or KB for your statement

    sw2090
    SuperUser
    sw2090
    SuperUser
    December 18, 2019

    If you use SD-WAN then SD-WAn will choose the ISP accoardig to the configured blancing algorithm. IF you then connect to your banking server this will be used. Additionally this will create a session on your FGT for this connection.

    As long as this session exists it will be reused for any connection from you to your banking. Sessions get dropped if they are not in use and reach their TTL, or if they are deleted by user.

    If the session is gone SD-WAN could change the ISP and create a new one.

     

    If you do need this to _always_ use the same ISP guaranteed you could create an sd-wan rule for this connection.

    ShawnZA
    ShawnZA
    New Member
    December 19, 2019

    Banking works fine with SD WAN.

     

    Traffic does not go out over one interface and comes back over another, that is incorrect. The traffic will come back to the NAT IP your session went out over, so you will not have any issues.

    sw2090
    SuperUser
    sw2090
    SuperUser
    December 20, 2019

    yeah that is what I tried to explain :)

     

    Terms & ConditionsAccessibility statement