Cannot in accessing internal web server after connecting wan2

[#1]

Product: FortiWiFi-60 FW: FortiOS 3.000 Recently I have activated wan2 and since then I cannot access the internal web server using the public URL. When pinging the URL from the internal network it successfully resolves and pings to it’s public IP. Tracert also shows single hop. These results are same as when only wan1 is connected. When WAN2 is disabled, access is OK. Wan1 and wan2 shows as default routes and wan1 is preferred - configured using CLI I have played around with policy routing but couldn’t resolve issue I need some help to get my head around this.

[Fireshield]

Is the web server public IP on the WAN1 or WAN2 port? Sounds like WAN1 but I' d want to be sure. Does all your outbound traffic work? If so, what IP is that traffic coming from? You can check that at http://www.dslreports.com/ip. You shouldn' t need a policy route for inbound traffic in this scenario. The session will start on the interface that the traffic comes in on so responses will follow the session back out that interface.

[#3]

Web server public IP is on the WAN1. This server can be accessed externally. Problem arises when we try to access it from the LAN using it' s URL which resolves to it' s Public IP address. This works fine when wan2 is disabled. When two default routes are set with priority to wan2, all internal traffice goes through wan2. That' s fine and that' s how I want it to be. wan2 for all outboud traffic and wan1 for all inbound traffic: HTTP, SMTP, VPN etc. These services use multiple Public IPs configured on wan1. With wan2 enabled and default routes set even without any policy routing outbound traffic loadbalances between the two interfaces. I introduced a policy route to funnel traffic through wan2.

[#4]

Try turning on Nat. In your WAN1 -> WebServer fw policy, check the Nat box. Let me know. -gsgi

[#5]

Hi there, Looks like I have the same problem, but not sure the situation is the same. The device is fgt-60, os 3.0 mr2. A web server on dmz using port mapping vip. Originally, I connect only wan1 and everything is ok: internal network has access to outside internet, and the web server can be accessed from outside and internal(using its public url). Then, I try to use both wan ports for load sharing: let all traffic to and from web server go through wan2, and internal through wan1. The routing monitor page has the followings:(I change the real numbers) type network distance gateway interface static 0.0.0.0/0 1 100.100.50.100 ppp0 static 0.0.0.0/0 1 100.100.50.100 ppp1 connected 10.10.10.0/24 0 0.0.0.0 dmz connected 100.100.50.100/32 0 0.0.0.0 ppp0 connected 192.168.1.0/24 0 0.0.0.0 internal connected 100.100.100.1/32 0 0.0.0.0 ppp0 connected 100.100.101.3/32 0 0.0.0.0 ppp1 Before mannual adding any route, web server can be accessed from outside, but internal can not access the outside internet. I find that wan2 has smaller index no. than wan1 has when using cli command ' diag net int list' (not sure because of this). So, I add a policy route: protocal 0 incoming interface internal source addr 192.168.1.0/255.255.255.0 destination addr 0.0.0.0/0.0.0.0 outgoing interface wan1 gateway addr 0.0.0.0 Then, the internal to wan1 works, and wan2 to dmz still works too. Now I am supposed to set up a route for internal <-> dmz, but I did not. I thought the packet will go out from wan1 and then come back to wan2, and I can simply use its public url to access web server from internal rather than tell everyone in the office to use its real private ip. But this does not work. I can not use the public url to access web server from internal. Is my idea basically wrong? Or am I missing something? Hope I explain the situation clearly enough. Thanks for any response. Regards!

[Fireshield]

Mike99 - you will need to have a rule allowing traffic from the internal to DMZ even though you are technically accessing the public IP address. This is because the WAN2 IP address is locally connected and this traffic will never actually go out WAN1 and then back in WAN2. The Fortigate will translate the address and pass the traffic directly to the DMZ. You can still use the WAN2 public IP, but the traffic is technically internal > DMZ.

[#7]

Hi there, Thanks for the response from Fireshield. After a couple of days' try and error, I found out in my situation: 1. Do not manually set any route, only one firewall policy for internal to wan2. Oddly, this works for some computers, but some can not even access the internet. I can not find any reason for this. So, 2. Besides the firewall policy for internal to wan2, set up two policy routes: from internal to dmz, which allows the access to the web server on dmz from internal if i set up the following route. And from internal to wan1, which makes ' all' computers have access to the internet. Don' t quite understand the logic of this, but at least make it work. Regards!