Dual Routing

[Mahmood_Fraidoon]

Hi

Wan1 IP is 10.0.0.1

Wan2 IP is 199.0.0.1

Internal1 IP is 192.168.1.0

Internal2 IP is 172.17.1.0

I'm trying to make computers on Internal2 access the internet using Wan2 only.

I created 2 static routes as below:

0.0.0.0/0.0.0.0 Gateway 10.0.0.2

0.0.0.0/0.0.0.0 Gateway 199.0.0.2

both having distance 10 and priority 0

2 policies are created, Internal1 to Wan1 and Internal2 to Wan2

Since then computers on Internal1 keeps facing connectivity and slowness issues and when I try to change the distance and/or priority of wan2 then internal2 computers cant access internet.

any idea?!

[rwpatterson]

Policy routing is your friend. It's used in cases like yours when you want to 'bend' traffic away from it's primary course. Set up the parameters, and away you go. In your case, select the source subnet (and additionally any ports if needed), and the gateway. That should be it (in addition to a valid static route which you already have).

[Mahmood_Fraidoon]

Hello

Policy Routing didn't work for me. whenever I create a policy then L1 and L2 are not communicating to each others.

I have been selecting "any" in port field as so far i'm not sure which are all the ports required for L1 users to access the W1.

[Dave_Hall]

Mahmood Fraidoon wrote:

Policy Routing didn't work for me. whenever I create a policy then L1 and L2 are not communicating to each others.

So what's preventing you from also setting up policy routes for L1 and L2?

[Adrian_Lewis]

Tempted to suggest using two VDOMs with an inter-vdom link. Use one VDOM for wan1 and internal 1 and the other for wan2 and internal 2. Add static routes for internal 1 and 2 across the vdom link. Add two default routes per VDOM, one with larger priority number for the backup via the VDOM link.

A bit more complicated to setup and more firewall policies involved but less complicated in terms of routing and troubleshooting compared to policy routes. If not, you need to add further policy routes to enable internal 1 to internal 2 traffic and place them above the internet policy routes.

Policy routes override everything, including connected routes - this is the issue you're facing at the moment. The choice depends on whether there are other management advantages to either method. Two distinct VDOMs would make separating other differences between the two networks much easier as well. Depending on the model and the amount of traffic passing between internal 1 and internal 2 you might find that performance gets hit as well as VDOM links in some boxes are done purely in CPU.