I am new at forum as well at Fortinet Firewall.
I am working in a company at Greece. We have Fortigate 100E with 6.4.1. Before i mention my problem let me explain you my topology.
We have 2 ISP on WAN 1 and WAN 2. On WAN 1 which connected to ISP1 we have a block of 16 static IPS and on WAN 2 he have ISP 2 with DSL connection, ISP modem/router in Bridge Mode and in WAN 2 on Fortigate PPPOE ( Username and password) with static IP.
On my Local Network i have my LOCAL LAN ( 192.168.230.0/24) and i have created 2 VLANS ( VLAN 100, 192.168.5.1/24 and VLAN 200, 192.168.8.1/24) under my LOCAL LAN. In the VLANS i have Servers ( Mail Server, FTP Server, Web Server, Web app Server etc)
My Goal is to achieve traffic from LOCAL LAN and VLAN 100 go through WAN1 ( I have setup in my WAN 1 secondary IPs so i can bind every server with one static IP ( one to one NAT) ) and i havee setup firewall policies. And VLAN 200 traffic go through WAN 2 ( PPPOE with Static) and bind two servers with static IP ( In this VLAN i have one Web Server and one MSQL Server, so its just a simple port forwading and policies to firewall).
Firstly i tried this step by step. First step i add my WAN1 with static IP (188.8.131.52/255.255.255.240) with secondary IPS 184.108.40.206-4-5-6. Static route to gateway 220.127.116.11 distance 10 priority 0.
Firewall Policy LOCAL LAN to WAN1 source LOCAL LAN Subnet destination all service all, nat enable. Everything is working, i have internet access. Second Firewall Policy VLAN 100 to WAN 1 source: VLAN 100 Subnet to WAN 1 Destination: all service: all, nat enable. Everything is working, i have internet access.
Third step VIRTUAL IP. ( In VLAN 100 i have 2 web servers, email server and ftp server). So i created 4 VIPS.
1) Name: WEBSERVER 1 Outgoing Interface: WAN1 External IP: 18.104.22.168 Inside IP: 192.168.5.11
2) Name: WEB Server 2 Outgoing Interface: WAN1 External IP: 22.214.171.124 Inside IP: 192.168.5.12
Fourth Step i create Firewall Policies so can i access the servers outside Inside Interface: WAN 1 Outside Interface: VLAN 100 source: all Destination: WEBSERVER 1 services HTTP, HTTPS etc. and of course NAT Disable.
I can access all my servers from outside. Everything great.
Then i add firewall policies,To access my VLAN from my LOCAL LAN. Everything ok. Until now all perfect.
1) LOCAL LAN->VLAN 100
2) VLAN 100 -> LOCAL LAN
After a few days i add the WAN2. ISP Modem in Bridge Mode and in Fortigate WAN2 PPPoE ( Username and password) connection ok. Static IP ok.
1) Name: WEBSERVER 3 Outgoing Interface: WAN2 External IP: 126.96.36.199 Inside IP: 192.168.8.10 Port Forward:8080 in all filelds.
2)Name: SQLSERVER 1 Outgoing Interface: WAN2 External IP: 188.8.131.52 Inside IP: 192.168.8.11 Port Forward:1433 all fields.
I create Firewall Policies so can i access the servers outside Inside Interface: WAN 2 Outside Interface: VLAN 200 source: all Destination: WEBSERVER 3 services HTTP, HTTPS etc. and of course NAT Disable. And the same for SQL Server.
And now the problem starts:
When WAN 2 is up ,traffic from LOCAL LAN and VLAN 100 doesnt go out from WAN 1. So i check WAN 2 and i saw distance 5. I change it to 10 and i add Policy Route (Incoming Interface: VLAN 200 Source Address : VLAN200 Subnet Destination: 0.0.0.0/0 or ALL ( i tried both) Outgoing Interface: WAN 2 Gateway: 0.0.0.0/0 ) BOOM ok VLAN 200 going traffic out from WAN2. But WAN 1 still Down. Second Policy Route ( Incoming Interface: LOCAL LAN, VLAN100 Source Address:LOCAL LAN, VLAN 100 Subnet Destination Address: 0.0.0.0/0 or ALL ( i tried both) Outgoing Interface: WAN1 Gateway:184.108.40.206) BOOM traffic from LOCAL LAN and VLAN 100foing out WAN 1.
But the problem is that i can access from LOCAL LAN the VLANS. I create Firewall Policies.
1) LOCAL LAN->VLAN 100
2) VLAN 100 -> LOCAL LAN
3) LOCAL LAN->VLAN 200
4) VLAN 200-> LOCAL LAN
5) VLAN 200-> VLAN 100
6)VLAN 100-> VLAN 200.
Nothing happened. I cant even ping the servers ( But i can ping gateways 192.168.5.1, 192.168.8.1). And beside all these i cant access my websites through public IP or private IPs ( I think this is Hairpin NAT something like this). But from different network ( From my Home computer or my mobile through 4G) i can access the websites without problem.
* I have Dlink Switch ( Default VLAN,VLAN 100,VLAN 200) port 1 trunk.
So to sum up.
WHY THIS IS HAPPENED?????
1) Why i cant access my servers ( Remote Desktop,ping)?
2) How can i set up Hairpin NAT?
Is it something wrong with my WAN setup. Please help me i am going to lose my mind.
So in your description you set source as the vlan and destination as 0.0.0.0 and selected a WAN interface - This means that anything coming from the vlan will be directed out the WAN interface rather than whatever interface it normally would have went.
You have to be careful with policy routes and be as specific as possible. Or, create another policy route above it that has source as the internal subnets and destination as internal subnets and tell it to 'stop policy routes' which it will then fallback on regular routes
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.