2 WAN ports, load sharing, transparent mode

[dvdsmith]

I' m planning for the possible addition of a 2nd WAN connection. I' ve never done this, so can anyone tell me if there is a fatal flaw in the plan below. The reason I ask is it may affect future ISP/telcom choices. I currently have an FGT-100A operating in transparent mode. For reasons I do not want bore anyone with, NAT mode is not an option. Once in place the topology will be such that the internal LAN, FGT-100A and both WAN routers downstream ports connected to WAN1 and WAN2 are all on the same subnet. There will be a route to each gateway in the routing table with the same distance value (are these even necessary since I' m in transparent mode?). All workstations will have both routers configured in their TCP/IP settings. Some that require access to the WAN1 router will have it listed first, while others will list the WAN2 router as their first choice. Identical policies will exist for Int->WAN1 and Int->WAN2. The DNS are accessible through either ISP. If I understand all this correctly, when both routers are available, the first group of workstations I mentioned will always use WAN1, while the second will always use WAN2. If one ISP goes down, all traffic should immediately failover to the other. Any obvious problems here? Thanks, David

[romanr]

ORIGINAL: dvdsmith Any obvious problems here? Thanks, David

Yes! A Fortigate in transparent mode won' t affect any routing or load balancing at all, it will just act as a switch with access control and filtering in between. All discussions around load balancing with Fortigate are for NAT/Route mode only!

[dvdsmith]

romanr, Thanks for the response. What I want to know is, what will happen when you hook up routers to both WAN ports and the workstations are configured as described. They are not getting DHCP or anything from the fortigate. I' m not interested in Load Balancing, which based on other posts in this forum is different from a basic failover setup like I' m after. Will their having both routers in their table allow them to use either one based on availability? Thanks, David

[UkWizard]

Yes and no, microsoft networking will only use alternative routes when the first route does not reply whatsoever, therefore to force clients to use the second alternative route, the routers themselves would need disconnecting or turning off. If they reply to any requests whatsoever, the second route will not get used. So best to turn off the non-working ISP line to force clients to use the other. NOTE though, this is a very clunky M$ implementation, and clients might even have to reboot, You would need different metrics to force one to be the primary route as well, on the clients. Obviously all the above is nothing whatsoever to do with the fortigate. its all O/S stuff, the fortinet just bridges the traffic and controls it. It would be a much better move to get the fortinet into NAT mode, as this will do all failover for you.