2 internal interfaces and 2 wan

[paulcpk]

We have a FortiGate 100C. We have 2 internal networks -- LAN1 and LAN2 We have 2 broadbands -- WAN1 and WAN2 We want LAN1 to access internet only through WAN1, and LAN 2 to access internet only through WAN2. We also want LAN1 to be able to access LAN2 and vice versa. How should we configure the 100C to achieve this? If we set the gateway of WAN1 and WAN2 to have same distance and priority, firewall policy LAN1 to WAN1; LAN2 to WAN2; LAN1 to LAN2 and LAN2 to LAN1, then only PCs in LAN1 with IP addresses ending with even number (the last octet) can access the internet (through WAN1). Since we need LAN1 to be able to access LAN2 and vice versa, is it correct that we cannot use VDOM?

[rocampo]

You can use VDOMs to this by creating " InterVDOM Links" to allow communications between VDOMs ( LAN1VDOM and LAN2VDOM ) But with your setup as you described it you can already allow communications between LAN 1 and LAN 2 by just creating necessary firewall policies. LAN 1---> LAN 2 allow any LAN 2 --> LAN 1 allow any you also probably will need to create the necessary Policy based routing policies, since I guess you might have created ones already to force traffic out of the different WAN ports. you will need to have LAN 1 IP network going to LAN 2 IP network force to LAN 2 port LAN 2 IP network going to LAN 1 IP network force to LAN 1 port

[MohanFC]

Hi, Since you are using the same distance & priority the ECMP would come in to the picture. due to which the fortigate is trying to do a source address based load balancing. So I would recommend you to change the priority of the static routes. Hopefulle this should solve the issue. regards,

[ede_pfau]

Hi, this has been discussed and solved just this week under the topic of " Unethical scenario" by fellow user laf. http://support.fortinet.com/forum/tm.asp?m=63266&appid=&p=&mpage=1&key=&language=single&tmode=&smode=&s=#66123 In essence, if you absolutely want to have a direct association of wan1 to lan1, wan2 to lan2 then you may either use policy based routing or VDOMs (virtual firewalls) with an interVDOM link. You find example setups for both either in the FortiOS Handbook or in a KnowledgeBase article. In your case with equal distance default (!) routes the Fortigate chooses the wan port according to the source IP (not: the source subnet like you would like to have). This is such that a session from a host is routed over the same wan port all the time. You could achieve full WAN connectivity for lan1 if you create an additional policy ' lan1' to ' wan2' , and ' lan2' to ' wan1' . This would use both wan ports for all clients but would not strictly separate traffic from the lan ports. @MohanFC: if you change priority or distance of the 2 default routes then only one will be preferred, that is, used until it fails. In case of failure traffic will be routed over the second wan which now idles along. @rocampo: I don' t see why you would have to use policy routing for the inter-LAN traffic. Simple static routes would do if the Fortigate had none - routes to lan1 and lan2 are added automatically on creation of the interface IPs. So no further action needed here other than 2 policies.

[paulcpk]

ede_pfau

Thank you ede_pfau. With both default gateway having the same priority, I put in policy route for LAN2 to WAN2, but still only half of the IPs of LAN1 and LAN2 can access Internet. I deliberately changed the gateway address of the outgoing interface (WAN2) to an invalid address, immediately no IP on LAN2 can access Internet. Thus it seems the policy route is working but the result is not what I expected. After changing the priority of the default gateway of WAN2 from 0 to 10, all IPs in LAN1 can access Internet through WAN1. However, All IPs on LAN2 cannot access Internet. The senario is as follows: 0.0.0.0 0.0.0.0 WAN1_gateway priority 0 0.0.0.0 0.0.0.0 WAN1_gateway priority 10 Firewall policy: LAN1 --> WAN1 allow any with NAT LAN2 --> WAN2 allow any with NAT Policy route: Protocol -- 6 Incoming Interface -- LAN2 Source address -- 192.168.1.0/255.255.255.0 Destination address -- 0.0.0.0/0.0.0.0 Destination Ports -- 1~65535 Type of service -- 00 00 Force traffic to -- WAN2 Gateway address -- WAN2_gateway Since the priority of WAN1 is higher than WAN2, I gues that s no need for a policy route for LAN1 to WAN1. Why LAN2 cannot access WAN2 even there is a policy route? Is there something wrong with the settings of the policy route? Have I missed something?

[ede_pfau]

Hi again, 1.

0.0.0.0 0.0.0.0 WAN1_gateway priority 10

is a typo, right? should read " WAN2_gateway" 2. delete the default route to WAN2 3. policy route: protocol=0 (6 is TCP only) With no default route pointing to WAN2, the only traffic arriving there must be via the policy route.

[ede_pfau]

I just noticed you have cross-posted into an old thread http://support.fortinet.com/forum/tm.asp?m=63266&appid=&p=&mpage=1&key=&language=&tmode=&smode=&s=#66619 and already getting help there. You are wasting time and resources - mine and that of the other participants.

[paulcpk]

@ede_pfau Sorry for the cross-post. I don' t meant to waste your time and that of other participants. I won' t do this again. I just want to get more answers and solve the problem ASAP only. In fact, your help is much appreciated!