Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
mikefoulos
New Contributor

Fortigate 100E 6.4.1

Fortigate 100E 6.4.1

Hello guys, I am new at forum as well at Fortinet Firewall. I am working in a company at Greece. We have Fortigate 100E with 6.4.1. Before i mention my problem let me explain you my topology. We have 2 ISP on WAN 1 and WAN 2. On WAN 1 which connected to ISP1 we have a block of 16 static IPS and on WAN 2 he have ISP 2 with DSL connection, ISP modem/router in Bridge Mode and in WAN 2 on Fortigate PPPOE ( Username and password) with static IP. On my Local Network i have my LOCAL LAN ( 192.168.230.0/24) and i have created 2 VLANS ( VLAN 100, 192.168.5.1/24 and VLAN 200, 192.168.8.1/24) under my LOCAL LAN. In the VLANS i have Servers ( Mail Server, FTP Server, Web Server, Web app Server etc) My Goal is to achieve traffic from LOCAL LAN and VLAN 100 go through WAN1 ( I have setup in my WAN 1 secondary IPs so i can bind every server with one static IP ( one to one NAT) ) and i havee setup firewall policies. And VLAN 200 traffic go through WAN 2 ( PPPOE with Static) and bind two servers with static IP ( In this VLAN i have one Web Server and one MSQL Server, so its just a simple port forwading and policies to firewall). Firstly i tried this step by step. First step i add my WAN1 with static IP (1.1.1.2/255.255.255.240) with secondary IPS 1.1.1.3-4-5-6. Static route to gateway 1.1.1.1 distance 10 priority 0.   Firewall Policy LOCAL LAN to WAN1 source LOCAL LAN Subnet destination all service all, nat enable. Everything is working, i have internet access. Second Firewall Policy VLAN 100 to WAN 1 source: VLAN 100 Subnet to WAN 1 Destination: all service: all, nat enable. Everything is working, i have internet access.   Third step VIRTUAL IP. ( In VLAN 100 i have 2 web servers, email server and ftp server). So i created 4 VIPS. 1) Name: WEBSERVER 1 Outgoing Interface: WAN1 External IP: 1.1.1.3 Inside IP: 192.168.5.11 2) Name: WEB Server 2  Outgoing Interface: WAN1 External IP: 1.1.1.4 Inside IP: 192.168.5.12 etc.   Fourth Step i create Firewall Policies so can i access the servers outside Inside Interface: WAN 1 Outside Interface: VLAN 100 source: all Destination: WEBSERVER 1 services HTTP, HTTPS etc. and of course NAT Disable.   I can access all my servers from outside. Everything great.   Then i add firewall policies,To access my VLAN from my LOCAL LAN. Everything ok. Until now all perfect.   1) LOCAL LAN->VLAN 100 2) VLAN 100 -> LOCAL LAN     After a few days i add the WAN2. ISP Modem in Bridge Mode and in Fortigate WAN2 PPPoE ( Username and password) connection ok. Static IP ok.   VIrtual IP 1) Name: WEBSERVER 3 Outgoing Interface: WAN2 External IP: 2.2.2.2 Inside IP: 192.168.8.10 Port Forward:8080 in all filelds. 2)Name: SQLSERVER 1 Outgoing Interface: WAN2 External IP: 2.2.2.2 Inside IP: 192.168.8.11 Port Forward:1433 all fields.   I create Firewall Policies so can i access the servers outside Inside Interface: WAN 2 Outside Interface: VLAN 200 source: all Destination: WEBSERVER 3 services HTTP, HTTPS etc. and of course NAT Disable. And the same for SQL Server.   And now the problem starts:   When WAN 2 is up ,traffic from LOCAL LAN and VLAN 100 doesnt go out from WAN 1. So i check WAN 2 and i saw distance 5. I change it to 10 and i add Policy Route (Incoming Interface: VLAN 200 Source Address : VLAN200 Subnet Destination: 0.0.0.0/0 or ALL ( i tried both) Outgoing Interface: WAN 2 Gateway: 0.0.0.0/0 ) BOOM ok VLAN 200 going traffic out from WAN2. But WAN 1 still Down. Second Policy Route ( Incoming Interface: LOCAL LAN, VLAN100 Source Address:LOCAL LAN, VLAN 100 Subnet Destination Address: 0.0.0.0/0 or ALL ( i tried both) Outgoing Interface: WAN1 Gateway:1.1.1.1) BOOM traffic from LOCAL LAN and VLAN 100foing out WAN 1.   But the problem is that i can access from LOCAL LAN the VLANS. I create Firewall Policies. 1) LOCAL LAN->VLAN 100 2) VLAN 100 -> LOCAL LAN 3) LOCAL LAN->VLAN 200 4) VLAN 200-> LOCAL LAN 5) VLAN 200-> VLAN 100 6)VLAN 100-> VLAN 200.   Nothing happened. I cant even ping the servers ( But i can ping gateways 192.168.5.1, 192.168.8.1). And beside all these i cant access my websites through public IP or private IPs ( I think this is Hairpin NAT something like this). But from different network ( From my Home computer or my mobile through 4G)  i can access the websites without problem.   * I have Dlink Switch ( Default VLAN,VLAN 100,VLAN 200) port 1 trunk.   So to sum up.                                                             WHY THIS IS HAPPENED????? 1) Why i cant access my servers ( Remote Desktop,ping)? 2) How can i set up Hairpin NAT?   Is it something wrong with my WAN setup. Please help me i am going to lose my mind.

1 Solution
brycemd

Policy routes take priority over normal routes.

 

So in your description you set source as the vlan and destination as 0.0.0.0 and selected a WAN interface - This means that anything coming from the vlan will be directed out the WAN interface rather than whatever interface it normally would have went.

 

You have to be careful with policy routes and be as specific as possible. Or, create another policy route above it that has source as the internal subnets and destination as internal subnets and tell it to 'stop policy routes' which it will then fallback on regular routes

View solution in original post

13 REPLIES 13
sw2090
SuperUser
SuperUser

Maybe the most easiest way could be to enable sd-wan and put your wans in there and then create some sd-wan rules for your traffic. 

 

-- 

"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

-- "It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
mikefoulos

Ok, but why when i enable Policy Routes i lose connection with my VLANS?

 

Why i cant access my server with the FQDN or private IP?

mikefoulos

And is the o guide how to config SD-WAN for manage traffic through specific WAN. If i tried it and succeed and rebuild the Firewall Policies and VIP it will be everything ok.

mikefoulos

Ok, but why when i enable Policy Routes i lose connection with my VLANS?   Why i cant access my server with the FQDN or private IP?

mikefoulos

Alexis G.

 

I have made this build with Watchguard at least 4 times and i have never problem.

 

mikefoulos

brycemd

 

I will try it fisrt with my current config.

 

So i ll place above my current Policy routes , policies from my VLANS to LOCAL LAN and my LOCAL LAN to VLANS wit stop policy route and the i ll set traffic from interfaces to the specific WAN.

mikefoulos

Ok guys,

 

I have succeed about 80%.

 

Now the problem is i cant reach my Webserver that is in VLAN 200 and goes out through WAN2. I can ping the server ,i am connecting remotely but i can open webpage through external IP or Internal.

 

From my mobile or other network i can reach it. Any thoughts??

poundy

debug flow trace :) 

sw2090

if you create sd-wan rules like I suggested you won't loose anything.

 

-- 

"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

-- "It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
Labels
Top Kudoed Authors