Skip to main content
Norris81
Norris81
Visitor III
February 14, 2025
Solved

WAN Failover NAT Issues

  • February 14, 2025
  • 1 reply
  • 1343 views

Hi All,

I'm trying to configure a WAN2 failover but I'm getting stuck on NAT.

I have a primary leased line internet circuit on WAN1.

I have a secondary FTTC internet circuit on WAN2

Both WAN interfaces are in a WAN-ZONE.

All firewall policies currently have a specific outbound NAT address with a dynamic ip pool address.

This outbound NAT address is different to the public IP assigned to the firewall.

The IP Pool addresses are Overload addresses.

I have several IP Pool addresses with incremented public ip addresses assigned.

Some firewall policies will have different outbound NAT IP Pool address.

It is a single public IP from the range allocated to the internet circuit on WAN1.

 

I plan to configure link-monitor to detect when there is problem with WAN1, override the current static routes and send all outbound traffic via WAN2.

 

The problem.

 

When testing, If a client hits a policy like this below, it cannot get to the internet.

This is due to the option, "Use Dynamic IP Pool" and the fact that "Outbound_NAT_9.19" is not a IP from the WAN2 ISPs network.

Policy.jpg

If I set it to "Use Outgoing Interface Address", it works, but then I will not be able to specify the Outbound NAT address that I want to use.

 

What's the best way configure this?

I'm not really looking to use SD-WAN, as 99% of the time all traffic should use WAN1 and only WAN2 if WAN1 is unavailable.

 

WAN1 is 1Gb Leased Line, WAN2 is 80Mb FTTC.

 

Below is screenshots of the other related configs.

Outbound Nat.jpgStatic Routes.jpgWAN2.jpg
Zones.jpg

 

 

 

Best answer by Jirka1

In the dynamic pool, you must have all pools specified (for both wan1 and wan2) and then add them to the policy at the same time. 
It is also necessary to define which pools are on which interface, e.g.:

 

config firewall ippool     edit "wan2-pool1"         set startip xx.xxx.xxx.xxx         set endip xxx.xxx.xxx.xxx         set associated-interface "wan2"     next end


 Jirka

1 reply

Jirka1
Jirka1Answer
Explorer II
February 14, 2025

In the dynamic pool, you must have all pools specified (for both wan1 and wan2) and then add them to the policy at the same time. 
It is also necessary to define which pools are on which interface, e.g.:

 

config firewall ippool     edit "wan2-pool1"         set startip xx.xxx.xxx.xxx         set endip xxx.xxx.xxx.xxx         set associated-interface "wan2"     next end


 Jirka

    Norris81
    Norris81Author
    Visitor III
    February 14, 2025

    @Jirka1 Thanks for the reply.

    I did add the WAN2 IP Pool address into the dynamic interface, but as I didn't specify the associated interface it did not route.

     

    I will try adding the associated-interface parameter in the next few days and report back.

    Terms & ConditionsAccessibility statement