SSL VPN with dual ISP config suggestions

this should solve the symmetric routing

as per user impact if one link goes down, i think that this cant be avoided since the actual link would be unavailable. just configured both remote gw in the config and upon disconnect when the user connects again it will use the other available connection

Hi ​@Raj_Pandey ,

To address your SSL VPN and internal server DNAT concerns, the following configuration might help you. 

You can set up route priorities while maintaining the same Administrative Distance (AD) value for both static routes. For example:
Such as : 

config router static
    edit 1
        set dst 0.0.0.0/0
        set gateway <ISP1_GW>
        set device "wan1"
        set distance 10    <--------- Same AD
    next
    edit 2
        set dst 0.0.0.0/0
        set gateway <ISP2_GW>
        set device "wan2"
        set distance 10    <--------- Same AD
        set priority 10    <--------- Configure route priority here
    next
end

With this configuration, the firewall will install both routes into the Routing table, and both will be considered best routes. However, traffic originating from the LAN side will always prefer the route with the lowest priority value and which will be WAN1 since default priority as 1 and traffic will be sent via WAN1.

Regarding your SSL VPN and DNAT setup, If traffic coming from outside (as original direction) as ingress to WAN2, then return traffic will be routed through WAN2 in a symmetrical manner.

Reference article : 

If you have found a solution, please like and mark it as solved to make it easily accessible for everyone.

Thanks,
Mayur Padma

Hi ​@Raj_Pandey 

When you configure two default routes WAN1 (distance 10) as preferred and WAN2 (distance 20) as backup. The FortiGate will use WAN1 for all outbound traffic as long as it is up. When a user connects through WAN2 public IP for SSL VPN, the return route selection still prefers WAN1 due to the lower administrative distance. This can create asymmetric routing, where the incoming session (from WAN2) attempts to send its return traffic via WAN1, resulting in dropped packets.
Make sure the AD value remains the same for both the route 10 and set the priority high for WAN2 in that case both the default route from wan1 and wan2 stay active in the routing table with WAN1 being primary route based on lower priority value.

For internal servers using DNAT (VIPs):

• Define separate VIPs per WAN interface matching each ISP’s public address range.
• Create identical firewall policies referencing each interface-specific VIP.
• Both route should be active in the routing table with same AD value and different priority

If you have found a solution, please like and mark it as solved to make it easily accessible for everyone.