WAN LLB & Policy Routes

Forum|Forum|8 years ago
September 5, 2017
8 replies
12181 views

Hi

I am new to Fortigate and i've got a query regarding my setup.

Device 100E running v5.4.5,build6225.

I've created a WAN LLB for interfaces WAN1 & WAN2 and setup LLB rules to priortise oubound traffic out certain interfaces. This works fine and fails over if one interface goes down.

For inbound i've created policy routes as certain traffic on each WAN interface needs to be directed to different destinations.

for e.g - inbound traffic on WAN1 on port 80 routed to 192.168.3.3

inbound traffic on WAN2 on port 80 routed to 10.0.0.10

The FW rules have been created to allow this traffic but as i've created a LB i can't select the individual interfaces but only the WAN-load-balance.

The FW is not yet in production but i'm just wondering whether this setup will work?

Allan_Lago

New Member

Hello dbrady ,

Policyt route will work fine if want to route traffic trought a especif internet Link. But to Inbound NAt you have to use a VIP object with a firewall policy.

Go to Policy and Objects > Virtual Ips > Create a new VIP object to match your NAT requirements.

To route Inbound Traffic From WAN1:80 to 192.168.3.3:80 you must have somthing like this:

config firewall vip edit "NAT_HTTP" set extintf "wan1" set portforward enable set mappedip "192.168.3.3" set extport 80 set mappedport 80 next end

After you create a VIP object you have to create a Firewall rule to allow this traffic.

config firewall policy edit 0 set srcintf "wan1" set dstintf "internal1" set srcaddr "all" set dstaddr "NAT_HTTP" set action accept set schedule "always" set service "ALL" set logtraffic all next

If you do this thought the GUI remeber to disable NAT on your firewall policy.