Auto last hop feature for 2 WAN links ?

[nicovpp]

I have a Fortigate FG60B running 4.0MR3. Please directly go to last post My network / server configuration is : - 2 wan links (WAN1 / WAN2) - 1 server in DMZ (and 1 different VIP for WAN1 / WAN2 access) Trafic is coming from internet (0.0.0.0/0). I would like that the response for trafic coming from WAN1 to DMZ, goes back to WAN1, and the same behaviour for WAN2. Is there a way to apply a such configuration ? Thanks !

[GusTech]

response for trafic

I' m not sure if I understand you right. However, if you want, for example ICMP reply directly from WAN1. then you need to set up your VIP only to the ports you want the DMZ to answer. What " response for trafic" do you mean? How is your VIP setup now?

[nicovpp]

I have made a drawing of my setup I hope it will be clearer with it. Maybe this is working without any special configuration but I was not able to make it work in test environment. (no DG for wan1 would be even better with my configuration)

[GusTech]

As far as i can see this should work. You have remembered to allow out traffic in policy from your dmz to wan2 and also wan1. Or, perhaps policy routes can help you out.

[nicovpp]

In fact in my test environment I didn' t put a DG on Wan1 but only on wan2 and it didn' t work. I will try to add as in my draw a second DG with a distance of 10. I just put a policy allowing trafic from Wan1 to dmz for 1st VIP and from wan2 to dmz for 2nd vip. I do not need to allow out traffic as this is an incoming request so response is allowed. The problem with policy routing is that it doesn' t keep track of incoming request interface (from wan1 to DMZ) for response (from DMZ to ... )

[nicovpp]

I have just setup it again on my testing environment. If wan2 is my default gateway (0.0.0.0/0) and if wan1 is not my default gateway (or DG with a higher distance) incoming packet on wan1 (wan1 VIP) is droped by the firewall (not reaching the server)). In this case incoming packet on WAN2 (wan2 VIP) is OK. If I changed my DG to WAN1, packet coming from wan1 (wan1 VIP) is OK, but from wan2 (wan2 VIP) is droped

[nicovpp]

A little update : Using same distance for my 2 DG (ECMP) works fine for incoming trafic / response for each interfaces. What I now want is only using wan2 for an outgoing request (request from DMZ to internet). I do not want to use policy routing (I know it would work) but I would like to know if the " Weighted Load Balance" ECMP method would work if I set wan1 weight to 0 and wan2 weight to 4294967295. Will it work in this configuration or am I required to use policy routing ? Thanks !

[nicovpp]

And here is the updated graph of my problem : I would like to use ECMP weighted load balance routing method for wan1 & wan2 interfaces, but I would like to only use wan2 for outgoing traffic (from int1, int2... interfaces). Here is my routing configuration : - wan2 = 0.0.0.0/0, dist = 10, weight = 4294967295 - wan1 = 0.0.0.0/0, dist = 10, weight = 0 I know that I could : - use policy routing - specify a higher distance for wan1 interface (and use a ping server ...) But I do not want to use these features in that specific case (which is more complex). Will the ECMP weighted load balance only use wan2 interface for outgoing traffic with such configuration (or will it sometimes use wan1) ?