Additional WAN interfaces

[Dustin]

Hello,

High level, I have a 100D running OS 5.4, 2 ISPs with multiple public static IPs.

WAN 1 and WAN 2 are setup in WLLB so traffic uses WAN1 with Failover to WAN2. 

I have configured 2 Hardware Switches grouping ports 1-8 for LAN and ports 9-12 for VoIP.

My configuration is setup where the LAN in on a separate subnet (and internal switch) from the VoIP.

I use WLLB Rules to route VoIP traffic out WAN2 and rely on the WLLB to control failover support.

Now, I would like to setup an additional port (port 15) as another WAN port with a static IP from my WAN1 ISP provider.

I'll use this port as my endpoint for site to site IPSec VPN tunnels and would like to route the traffic to the LAN subnet.

When I try to configure the port (which is in interface mode) to an external IP, I get an error message that the subnet conflicts with WAN1. 

Am I missing a step or is there a better way to configure an additional WAN port on the same external subnet?

Other suggestions?

Thanks

[Dustin]

Follow up I found something related to the issue, 

config sys settings set allow-subnet-overlap enable end

Is there a down side to this?

[ede_pfau · Accepted solution]

You can't.

The FGT (in routing mode) is a router, each interface connects to a different network. Which in other words means that no 2 interfaces can be in the same network.

What you can do is create a VIP (virtual IP address) on the WAN interface with the second public IP. The FGT will then respond on behalf of the VIP. Physically, this would use only one port.

[Dustin]

Thank you for the reply.

I was digging around and found a CLI command which looks like what I need; 

allow-subnet-overlap Enable/disable

= allow one interface subnet overlap with other interfaces.

Have you used this feature?

[ede_pfau]

I was hoping you wouldn't find it...honestly.

This command will allow overlapping address ranges at the expense of nullifying the built-in anti-spoof feature. In my opinion it covers up flaws in the scheme by giving up one of the principle protections of a firewall.

You should be aware of this before going down that road. There are alternatives I think.

[Dustin]

I guess my main concern is putting too much load on 1 interface. Setting up additional WAN interfaces could offload and increase traffic performance, security and redundancy.

I'm already using the WLLB for failover between my 2 ISP and I have a WLLB rule which directs VoIP traffic out the WAN2 (where all other traffic goes out WAN1) and thus if WAN2 fails, VoIP traffic fails over to WAN1. The same goes for WAN1, should it fail, traffic fails over to WAN2. I do this to utilize the WAN2 bandwidth for VoIP traffic only and as a failover for primary WAN.

I would like to setup a separate interface for VPN traffic (both site to site and client connections) and offload the WAN1 interface traffic volume, provide more policy/security options and physical redundancy. I guess I could setup a redundant interface with two ports for WAN1 in order to fulfill the physical redundancy concern but doesn't address the work load on WAN1 interface.

Another option would be to setup VDOMs with interlinking policies but seems a little over kill.

Other thoughts?

[Ralph1973]

I think it doesn't make much difference when you add a 3rd wan interface, because of performance gain.

Most resources are used by UTM but also encryption/decryption of the IPsec traffic. So better take a look at if ipsec traffic is offloaded to CP. 100d has a CP8