Add ISP to WAN2 (FortiGate 60E)

[mdnoor]

Hi all,

im new in fortigate currently we use fortigate 60e and inside already config use wan1 from ISP setup by previous people, now the company just purchase new ISP from different ISP which is i need to add at WAN2 but after i follow the cookbook config i unable to connect the internet for wan2. can some one help me how can i config wan2?

in picture i already remove back the config

reference basic config:

https://docs.fortinet.com...ecting-network-devices

[sw2090]

there is bascially two ways to achieve that:

1. Two seperate WANs (WAN1 and WAN2) with sperate ISPs. In this case you have to create two default routes. If yu want WAN2 to be fallback in this constellation make sure that the default route for WAN2 has the higher priority/distance than the WAN1 one.

If there is more than one route for a target (in this case the internet) routes are matched by priority and then distance. So traffic would primarily use the WAN with loweset routing prio and then if that don't work use the other one. This has the disadvantage that there will be no real loadbalancing - just failover.

Also you need to have every internet policy twice (one for every WAN).

2. Use SD-WAN instead. In this case you need only one default route that uses sd-wan as interface. All Internet policies must use sd-wan as interface for traffic from/to the internet.

SD-WAN implements several loadbalancing algorithms and also allows you to set own rules for balancing.

Once you also set up some SD-WAN health check(s) the sd-wan also cares for failover. When the health check(s) detect a WAN being unavailable it will automatically be dropped from sd-wan and is no longer used. Once health check reports the WAN being ok again it will automatically turn back into action and will be used again.

So you need less policy and routes. Also you don't need to change anything in tohe routing when a WAN goes down. SD-WAN does that automatically.

Disadvantage: (the only one I yet found for me) Using SD-WAN prevents you from having additional default routes. So if you want to have some WAN outside SD-WAN as fallback - that' snot possible with sd-wan.

(We would like to use cellular uplink as extra fallback but it would need to be outside sd-wan because using it is expensive and you cannot prevent sd-wan from using it once it is in there.)

[SecurityPlus]

Concerning #2 from sw2090, does FortiOS 6.4 add some additional options concerning SD-WAN management options?