FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
This article describes the process to consistently route a designated device via a chosen WAN interface, despite having an SD-WAN setup spanning both WAN1 and WAN2.
Scope
FortiOS
Solution
To route a specific device through WAN2 utilizing FortiGate's SD-WAN feature, follow the steps outlined below:
Step 1:Understand the requirements.
Assume the goal is to route the SMB server through WAN2, even though there is an SD-WAN configuration for both WAN1 and WAN2.
Step 2:Define SMB Server Address
Navigate to Policy & Objects -> Addresses -> Create New -> Address.
Create an address for the SMB server.
Step 3: Set up SD-WAN Rule for SMB Server
Go to Network -> SD-WAN -> SD-WAN Rules.
Select 'Create New' or 'Add'.
Configure the Rule:
Source: Set to the IP address of the SMB server.
Incoming Interface: The internal (LAN) interface.
Destination: Set to 'ALL' or as desired.
Protocol: Set to 'ALL' or as desired.
Outgoing Interface: Set to 'WAN2'.
Position the new rule to ensure it takes precedence, either at the top or above any other rule that might match the SMB server's traffic.
Step 4:Define Firewall Policy for SMB Server
Navigate to Policy & Objects -> IPv4 Policy.
Create a New Policy:
Incoming Interface: The internal (LAN) interface.
Outgoing Interface: virtual-wan-link.
Source:Address -> Select the SMB server's address defined earlier.
Destination: All or as desired.
Schedule: Always.
Service: ALL or specific services if desired.
Action: ACCEPT.
NAT: Enable.
Ensure this policy is placed correctly in the policy order.
Step 5:Testing the Configuration
After configuring, test the setup by running debug commands:
diagnose debug reset
diagnose debug disable
diagnose debug flow filter addr <SMB server's IP address>
diagnose debug flow trace start 100
diagnose debug enable
To stop the debug processes in the end, press 'Ctrl+C' and enter 'diagnose debug disable'.
Additionally, from the SMB server, try accessing the internet and monitor the FortiGate logs or the SD-WAN performance SLA monitor. Make sure the SMB server's traffic is routed via WAN2.
