Setting up and managing 2 WAN links

The difference between Scenario1 and Scenario3 is

- With Scenario1, you can't take VPNs on the secondary interface because the default route toward the secondary won't be in the routing-table unless the primary goes down and the primary default route is removed by the link-monitor. So the returning traffic would try to go out through the primary but would be dropped due to "asymmetric routing".

- With Scenario3, both default routes are in the routing-table with different priority so out-to-in initiated traffic like VPNs works because the FGT routes returning traffic to the same interface that came in.

The next my comment might not be 100% correct because my insight of SD-WAN's mechanism is not so deep. You might want to wait more answers from others. But my understanding of SD-WAN is it has same distance default routes to all Internet candidates and SD-WAN rules (conditional priority routes) decide which one to be chosen based on the criteria you set for the specific traffic and link health (packet loss, latency and jitter).

Of course you can set the default behavior when traffic doesn't much any rules to make the primary primary if you want instead of load balancing.

So it's more flexible but that means you need to configure the rules to make the routing decision behavior as you want.

Central NAT vs. NAT on policies are more personal preference, or previous experiences with different platform. But if you ask me my preference, I wouldn't go to central NAT because to me the config of C-NAT to specify the traffic is duplicated with policies most of cases. I'm too lazy to do that.

NAT works based on the conditions in the policy. So unrelated or separated from routing decision. You generally have to have two different NAT policies one for ISP1 and one for ISP2. It's not based only on source interface. Unless you combine those wan interfaces together into a "zone" then let the FGT pick what is the NAT outside IP. Just remember if you use zone, you can't create specific/different policies for wan1 and wan2. So in your case, when it's not simple failover, you can't use a zone.

You can't use ISP2's public IPs as source IP when you send packets out to ISP1. If you do that returning packets still come back to wan2 as long as the circuit is up (otherwise never come back), which is another way of "asymmetric routeing" and the FGT would drop those returning packets.

Toshi

Of course it works if specific routes are going to the secondary like for site-to-site or specific dialup source if it's static. Just need to have proper routes toward the interface.

And if you put the ISP2's IP in ippool to use the outside NAT IP for the primary interface, it of course goes out. The problem is its returning. Packets back from the destination to 172.10.10.10 would come back to the secondary because that IP belongs to ISP2,never to ISP1. At that time the FGT drops it because of "asymmetric".

No. Probably any other decent FWs would behave the same. Otherwise it would allow spoofing. If you want to do like that, either you need to have your own IP subnet with BGP ASN and advertise it to both ISP1 and 2, or set a L3 route in front of the FGT and let the router handle the routing, which doesn't care sessions and asymm routing. SD-WAN might be able to do something but I doubt.

Toshi