Ask - How To split 2 WAN connections for several ports

[kssupport]

Hi there,

need help please.

we have 2 WAN connections (WAN1 and WAN2), and has set ports as interface.

Where (and what the keyword to learn) for:

1. set certain interfaces use only WAN1 for internet connection

2. set other interfaces using only WAN2 for internet connection

3. the rest can use both of them (WAN1 and WAN2), either simultaneously/load balance

we use Fortigate FG-60, with firmware version v5.0,build4459 (GA)

Please need help.

thank you.

[ede_pfau]

hi,

for starters:

- traffic flow towards a WAN port is directed according to routes. See Network > Routes > Static. In case of multiple WAN ports, you would set up 2 default routes ('0.0.0.0/0') with the same distance. This is then called ECMP and the FGT will load-balance sessions (not: bandwidth!) among those ports.

- to divert traffic from a static route towards another port, use Policy Routing. PR is working just like routes, but additionally to the destination you can base the routing decision on source address, source port, destination port (not on: application, schedule, UTM filter,...).

Policy routes may be cumbersome sometimes as they don't show up in the routing table. They are checked before ordinary routing takes place.

Keywords: dual-WAN, ECMP, LLB, virtual WAN port; Policy based routing, policy routing.

[kssupport]

hi Ede,

thanks for your reply.

so, for load balancing, we need to set up 2 routes with same value, correct?

and I just notice that all our internet connection use dynamic IP public. usually we use forti ddns.

but since I only have 1 fortiddns, wondering how to make the policy route?

[ede_pfau]

routes:

you can set the equal distance in the GUI, non-equal priority in the CLI.

fortiddns:

AFAI see, DDNS has nothing to do with Policy routing - you route to an interface, not a URL.

[kssupport]

hi Ede,

sorry take long update. I thank you for your help.

the connection already successful for the beginning.

1. certain interface connect to internet use WAN1

2. WAN1 and WAN2 can connect to internet.

however, still I wondering whether it is capable or not (especially FG-60D):

1. have 2 ddns by default. provided by fortigate. since ISP only give dynamic IP public.

2. if just WAN2 down, can it be automatically use WAN1? but not in the other side.

3. set WAN2 as primary internet connection for certain function (update Fortigate, VPN IPSec, VPN SSL, and perhaps other main function such as pop and smtp)

Still I wish I have more enough time to discover the FG-60D. somehow I feel there are many feature for firewall and UTM.