Fortigate 100E 6.4.1

[mikefoulos]

Fortigate 100E 6.4.1

Hello guys, I am new at forum as well at Fortinet Firewall. I am working in a company at Greece. We have Fortigate 100E with 6.4.1. Before i mention my problem let me explain you my topology. We have 2 ISP on WAN 1 and WAN 2. On WAN 1 which connected to ISP1 we have a block of 16 static IPS and on WAN 2 he have ISP 2 with DSL connection, ISP modem/router in Bridge Mode and in WAN 2 on Fortigate PPPOE ( Username and password) with static IP. On my Local Network i have my LOCAL LAN ( 192.168.230.0/24) and i have created 2 VLANS ( VLAN 100, 192.168.5.1/24 and VLAN 200, 192.168.8.1/24) under my LOCAL LAN. In the VLANS i have Servers ( Mail Server, FTP Server, Web Server, Web app Server etc) My Goal is to achieve traffic from LOCAL LAN and VLAN 100 go through WAN1 ( I have setup in my WAN 1 secondary IPs so i can bind every server with one static IP ( one to one NAT) ) and i havee setup firewall policies. And VLAN 200 traffic go through WAN 2 ( PPPOE with Static) and bind two servers with static IP ( In this VLAN i have one Web Server and one MSQL Server, so its just a simple port forwading and policies to firewall). Firstly i tried this step by step. First step i add my WAN1 with static IP (1.1.1.2/255.255.255.240) with secondary IPS 1.1.1.3-4-5-6. Static route to gateway 1.1.1.1 distance 10 priority 0.   Firewall Policy LOCAL LAN to WAN1 source LOCAL LAN Subnet destination all service all, nat enable. Everything is working, i have internet access. Second Firewall Policy VLAN 100 to WAN 1 source: VLAN 100 Subnet to WAN 1 Destination: all service: all, nat enable. Everything is working, i have internet access.   Third step VIRTUAL IP. ( In VLAN 100 i have 2 web servers, email server and ftp server). So i created 4 VIPS. 1) Name: WEBSERVER 1 Outgoing Interface: WAN1 External IP: 1.1.1.3 Inside IP: 192.168.5.11 2) Name: WEB Server 2  Outgoing Interface: WAN1 External IP: 1.1.1.4 Inside IP: 192.168.5.12 etc.   Fourth Step i create Firewall Policies so can i access the servers outside Inside Interface: WAN 1 Outside Interface: VLAN 100 source: all Destination: WEBSERVER 1 services HTTP, HTTPS etc. and of course NAT Disable.   I can access all my servers from outside. Everything great.   Then i add firewall policies,To access my VLAN from my LOCAL LAN. Everything ok. Until now all perfect.   1) LOCAL LAN->VLAN 100 2) VLAN 100 -> LOCAL LAN     After a few days i add the WAN2. ISP Modem in Bridge Mode and in Fortigate WAN2 PPPoE ( Username and password) connection ok. Static IP ok.   VIrtual IP 1) Name: WEBSERVER 3 Outgoing Interface: WAN2 External IP: 2.2.2.2 Inside IP: 192.168.8.10 Port Forward:8080 in all filelds. 2)Name: SQLSERVER 1 Outgoing Interface: WAN2 External IP: 2.2.2.2 Inside IP: 192.168.8.11 Port Forward:1433 all fields.   I create Firewall Policies so can i access the servers outside Inside Interface: WAN 2 Outside Interface: VLAN 200 source: all Destination: WEBSERVER 3 services HTTP, HTTPS etc. and of course NAT Disable. And the same for SQL Server.   And now the problem starts:   When WAN 2 is up ,traffic from LOCAL LAN and VLAN 100 doesnt go out from WAN 1. So i check WAN 2 and i saw distance 5. I change it to 10 and i add Policy Route (Incoming Interface: VLAN 200 Source Address : VLAN200 Subnet Destination: 0.0.0.0/0 or ALL ( i tried both) Outgoing Interface: WAN 2 Gateway: 0.0.0.0/0 ) BOOM ok VLAN 200 going traffic out from WAN2. But WAN 1 still Down. Second Policy Route ( Incoming Interface: LOCAL LAN, VLAN100 Source Address:LOCAL LAN, VLAN 100 Subnet Destination Address: 0.0.0.0/0 or ALL ( i tried both) Outgoing Interface: WAN1 Gateway:1.1.1.1) BOOM traffic from LOCAL LAN and VLAN 100foing out WAN 1.   But the problem is that i can access from LOCAL LAN the VLANS. I create Firewall Policies. 1) LOCAL LAN->VLAN 100 2) VLAN 100 -> LOCAL LAN 3) LOCAL LAN->VLAN 200 4) VLAN 200-> LOCAL LAN 5) VLAN 200-> VLAN 100 6)VLAN 100-> VLAN 200.   Nothing happened. I cant even ping the servers ( But i can ping gateways 192.168.5.1, 192.168.8.1). And beside all these i cant access my websites through public IP or private IPs ( I think this is Hairpin NAT something like this). But from different network ( From my Home computer or my mobile through 4G)  i can access the websites without problem.   * I have Dlink Switch ( Default VLAN,VLAN 100,VLAN 200) port 1 trunk.   So to sum up.                                                             WHY THIS IS HAPPENED????? 1) Why i cant access my servers ( Remote Desktop,ping)? 2) How can i set up Hairpin NAT?   Is it something wrong with my WAN setup. Please help me i am going to lose my mind.

[sw2090]

well if you enable sd-wan and put your wans in there (and I recommend to also creade sla performance check to enable sd-wan to check if a wan is still there or not) it will do load blanacing accoarding to the algorithm set in the sd-wan rule #0. 

If there is other sd-wan rules before and the traffc matches those then it will use those.

So if you set a sd-wan rule stating that all traffic coming from vlan100 interface/subnet that wants to go to the internet (destination any / service any) should go over wan1 and put that before #0. All traffic coming from vlan100 interface/subnet will hit the internet via wan1. All other traffic doesn't match the rule and will hit #0 (Loadbalancing) then.

[Alexis_G]

I m sorry . but:

1. 6.4.1 is not considered a production release .

2. To my understanding you need professional services over this project.

I mean that your are not asking for just a detail over a configuration, you are trying to deploy a new IT System and do not know how to use Fortigate , trying to build it over a forum ??

Sorry

[brycemd · Accepted solution]

Policy routes take priority over normal routes.

So in your description you set source as the vlan and destination as 0.0.0.0 and selected a WAN interface - This means that anything coming from the vlan will be directed out the WAN interface rather than whatever interface it normally would have went.

You have to be careful with policy routes and be as specific as possible. Or, create another policy route above it that has source as the internal subnets and destination as internal subnets and tell it to 'stop policy routes' which it will then fallback on regular routes

[andrewbailey]

hi mikefoulos

I agree with what brycemd says above.

I also got caught recently by policy routes- in my case I re-routed by inbound traffic accidentally by using a "generic" route (think: any to SD-WAN).

You do not actually need policy routes for SD-WAN. They are not a requirement (as Tech Support confirmed to me). You can use them to steer traffic if you need to- but there are other approaches with SD-WAN.

Have you checked:-

https://docs.fortinet.com/sdwan

The documentation is pretty good really.

Kind Regards,

Andy.