Skip to main content
baze7
baze7
New Member
December 31, 2023
Question

VPN Dedicated WAN interface

  • December 31, 2023
  • 2 replies
  • 2617 views

I have 3 WAN interfaces. I want 1 of these to be dedicated for VPN traffic. I have setup several Site to Site IPsec Tunnels. They work fine as long at the WAN interface is the highest priority in the static routes. But I do not want outbound internet traffic to go out this interface, so if I adjust the priority of distance then the VPN won't connect. Can I somehow specify 1 IP in the destination of a static route to force the connection to use the interface I want to use? Or should I somehow do this a different way? There will eventually be 15 vpn connection I want to do this way.

 

 

2 replies

funkylicious
SuperUser
funkylicious
SuperUser
January 1, 2024

Hi,
One way of doing this would be through Policy Routes, where you specify the srcaddr and dstadd and the outbound interface as long as the main interface and this interface that you want to use for outbound traffic, would have the same distance/prio for ECMP so both are installed in the routing table.

A more flexibile way to do it would be to configure SDWAN and then configure the SDWAN rules to do basically the same thing as Policy Route but with more features/options.

"jack of all trades, master of none"
baze7
baze7Author
New Member
January 1, 2024

I thought about SDWAN. I will give that a shot also.

 

Thanks

johnathan
Staff
johnathan
Staff
January 1, 2024

"Can I somehow specify 1 IP in the destination of a static route to force the connection to use the interface I want to use?"
This is how I would do it, and not have a default route on that specific interface at all.

Another way to do it would be to have all three WAN interfaces be separated based on priority instead of distance.
When  you have the distance the same, they will all be active in the routing table and be able to send traffic. You can have WAN1 and WAN2 be a priority of 5, and your VPN-WAN priority of 6.


This would make it so user traffic will never go to VPN-WAN, unless WAN1 and WAN2 are both down. VPN tunnels  would still be able to establish, however.


See this document for a bit more detail: 
https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/25967/equal-cost-multi-path

Never trust a computer you can't throw out a window.
baze7
baze7Author
New Member
January 1, 2024

Thanks for the reply. How do I specify just 1 IP address is a static route?  Using a range and just put in the 1 IP?

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
January 2, 2024

config router static

  edit 0

    set dst x.x.x.x 255.255.255.255        <-- x.x.x.x is the site-to-site peer public IP
   either {
    set gateway <gateway_IP>  [if static]
    } or {

     set dynamic-gateway enable [if DHCP or PPPoE]
    }

    set device <the_wan_interface>

  next

end

 

Then don't set a default route to the same wan interface. If DHCP or PPPoE pulling the default gatway,

config sys int

  edit <the_wan_interface>

     set defaultgw disable
  next
end

 

Toshi

    Terms & ConditionsAccessibility statement