Fortigate 100D and 3 Internet connections.

[Zulhardy]

Hi all   I work in a school with a main office that has three Internet connections and a 100D. Two are dynamic IP Internet that are to be configured in WAN Link Load Balancing. The 3rd is a static connection for the main office staff.   The two Dynamic IP internet have gateways as follows and are configured as WAN Link Load Balancing. 10.0.1.253 (WAN1) 10.0.2.253 (WAN2)   Static Route shows below and Internet works in the classroom environment when policy is set for Class Network to WanLinkLoadBalace interface and NAT enabled. 0.0.0.0 0.0.0.0 wan-load-balance   My Static IP line is below and configured as  201.128.148.254 (PORT1)   However when I configure a policy for the Office Network to Port 1 interface and NAT enabled. Nobody in the office can surf the Internet. When I connected my laptop to the router directly, I can surf the Internet.   Am I missing something? Do I need to add another static route or a policy route? Thanks for any help.  

[ede_pfau]

hi,

but if you configure a policy from Office Network to 'wan-load-balance' interface your staff can surf.

But the third line would not be used.

The problem is that the FGT - as a router - supports one default route only per VDOM.

There are 2 workarounds:

- you configure a policy route which diverts traffic from the Office Network (= source address) to the 3rd interface. Note that this route will not show up in the Routing Monitor.

- you put the FGT into VDOM mode to create one more firewall instance (a virtual Fortigate) and use the existing 'root' VDOM for your classroom networks and the new VDOM for the Office network. Each VDOM can support one default route which solves your problem.

Both configurations are not off-hand, maybe it would be beneficial if you get professional help from a Fortinet partner for this.

[Dustin]

I'm new to Fortinet products and thus not really an expert but my first question is did you also configure a reverse policy? A policy that allows PORT1 to pass traffic back to Office Network?

[ede_pfau]

@Dustin:

For allowing reply traffic you don't need a separate policy - in fact, you don't want any policy 'WAN' -> 'internal' unless you want to make internal servers available on the Net.

Policies control whether a session is allowed to establish or not. Once the session is established (after the handshake) traffic is allowed to flow, and reply traffic is allowed to come in.

The reason why OP doesn't see traffic coming in is that the FGT will discard any traffic which doesn't have a valid route to. In case of WAN traffic, because of the unknown source addresses, you need a wildcard route, the default route '0.0.0.0/0' which matches any source. There can only be ONE default route per router, or per VDOM. Reply traffic is coming in on port1 but discarded.