Fortigate 100E 6.4.1

[mikefoulos]

Fortigate 100E 6.4.1

Hello guys, I am new at forum as well at Fortinet Firewall. I am working in a company at Greece. We have Fortigate 100E with 6.4.1. Before i mention my problem let me explain you my topology. We have 2 ISP on WAN 1 and WAN 2. On WAN 1 which connected to ISP1 we have a block of 16 static IPS and on WAN 2 he have ISP 2 with DSL connection, ISP modem/router in Bridge Mode and in WAN 2 on Fortigate PPPOE ( Username and password) with static IP. On my Local Network i have my LOCAL LAN ( 192.168.230.0/24) and i have created 2 VLANS ( VLAN 100, 192.168.5.1/24 and VLAN 200, 192.168.8.1/24) under my LOCAL LAN. In the VLANS i have Servers ( Mail Server, FTP Server, Web Server, Web app Server etc) My Goal is to achieve traffic from LOCAL LAN and VLAN 100 go through WAN1 ( I have setup in my WAN 1 secondary IPs so i can bind every server with one static IP ( one to one NAT) ) and i havee setup firewall policies. And VLAN 200 traffic go through WAN 2 ( PPPOE with Static) and bind two servers with static IP ( In this VLAN i have one Web Server and one MSQL Server, so its just a simple port forwading and policies to firewall). Firstly i tried this step by step. First step i add my WAN1 with static IP (1.1.1.2/255.255.255.240) with secondary IPS 1.1.1.3-4-5-6. Static route to gateway 1.1.1.1 distance 10 priority 0.   Firewall Policy LOCAL LAN to WAN1 source LOCAL LAN Subnet destination all service all, nat enable. Everything is working, i have internet access. Second Firewall Policy VLAN 100 to WAN 1 source: VLAN 100 Subnet to WAN 1 Destination: all service: all, nat enable. Everything is working, i have internet access.   Third step VIRTUAL IP. ( In VLAN 100 i have 2 web servers, email server and ftp server). So i created 4 VIPS. 1) Name: WEBSERVER 1 Outgoing Interface: WAN1 External IP: 1.1.1.3 Inside IP: 192.168.5.11 2) Name: WEB Server 2  Outgoing Interface: WAN1 External IP: 1.1.1.4 Inside IP: 192.168.5.12 etc.   Fourth Step i create Firewall Policies so can i access the servers outside Inside Interface: WAN 1 Outside Interface: VLAN 100 source: all Destination: WEBSERVER 1 services HTTP, HTTPS etc. and of course NAT Disable.   I can access all my servers from outside. Everything great.   Then i add firewall policies,To access my VLAN from my LOCAL LAN. Everything ok. Until now all perfect.   1) LOCAL LAN->VLAN 100 2) VLAN 100 -> LOCAL LAN     After a few days i add the WAN2. ISP Modem in Bridge Mode and in Fortigate WAN2 PPPoE ( Username and password) connection ok. Static IP ok.   VIrtual IP 1) Name: WEBSERVER 3 Outgoing Interface: WAN2 External IP: 2.2.2.2 Inside IP: 192.168.8.10 Port Forward:8080 in all filelds. 2)Name: SQLSERVER 1 Outgoing Interface: WAN2 External IP: 2.2.2.2 Inside IP: 192.168.8.11 Port Forward:1433 all fields.   I create Firewall Policies so can i access the servers outside Inside Interface: WAN 2 Outside Interface: VLAN 200 source: all Destination: WEBSERVER 3 services HTTP, HTTPS etc. and of course NAT Disable. And the same for SQL Server.   And now the problem starts:   When WAN 2 is up ,traffic from LOCAL LAN and VLAN 100 doesnt go out from WAN 1. So i check WAN 2 and i saw distance 5. I change it to 10 and i add Policy Route (Incoming Interface: VLAN 200 Source Address : VLAN200 Subnet Destination: 0.0.0.0/0 or ALL ( i tried both) Outgoing Interface: WAN 2 Gateway: 0.0.0.0/0 ) BOOM ok VLAN 200 going traffic out from WAN2. But WAN 1 still Down. Second Policy Route ( Incoming Interface: LOCAL LAN, VLAN100 Source Address:LOCAL LAN, VLAN 100 Subnet Destination Address: 0.0.0.0/0 or ALL ( i tried both) Outgoing Interface: WAN1 Gateway:1.1.1.1) BOOM traffic from LOCAL LAN and VLAN 100foing out WAN 1.   But the problem is that i can access from LOCAL LAN the VLANS. I create Firewall Policies. 1) LOCAL LAN->VLAN 100 2) VLAN 100 -> LOCAL LAN 3) LOCAL LAN->VLAN 200 4) VLAN 200-> LOCAL LAN 5) VLAN 200-> VLAN 100 6)VLAN 100-> VLAN 200.   Nothing happened. I cant even ping the servers ( But i can ping gateways 192.168.5.1, 192.168.8.1). And beside all these i cant access my websites through public IP or private IPs ( I think this is Hairpin NAT something like this). But from different network ( From my Home computer or my mobile through 4G)  i can access the websites without problem.   * I have Dlink Switch ( Default VLAN,VLAN 100,VLAN 200) port 1 trunk.   So to sum up.                                                             WHY THIS IS HAPPENED????? 1) Why i cant access my servers ( Remote Desktop,ping)? 2) How can i set up Hairpin NAT?   Is it something wrong with my WAN setup. Please help me i am going to lose my mind.

[sw2090]

Maybe the most easiest way could be to enable sd-wan and put your wans in there and then create some sd-wan rules for your traffic. 

[mikefoulos]

Ok, but why when i enable Policy Routes i lose connection with my VLANS?

Why i cant access my server with the FQDN or private IP?

[mikefoulos]

And is the o guide how to config SD-WAN for manage traffic through specific WAN. If i tried it and succeed and rebuild the Firewall Policies and VIP it will be everything ok.

[mikefoulos]

Ok, but why when i enable Policy Routes i lose connection with my VLANS?   Why i cant access my server with the FQDN or private IP?

[mikefoulos]

Alexis G.

I have made this build with Watchguard at least 4 times and i have never problem.

[mikefoulos]

brycemd

I will try it fisrt with my current config.

So i ll place above my current Policy routes , policies from my VLANS to LOCAL LAN and my LOCAL LAN to VLANS wit stop policy route and the i ll set traffic from interfaces to the specific WAN.

[mikefoulos]

Ok guys,

I have succeed about 80%.

Now the problem is i cant reach my Webserver that is in VLAN 200 and goes out through WAN2. I can ping the server ,i am connecting remotely but i can open webpage through external IP or Internal.

From my mobile or other network i can reach it. Any thoughts??

[poundy]

debug flow trace :) 

[sw2090]

if you create sd-wan rules like I suggested you won't loose anything.