Fortigate 100E Multiple WAN Connection

[Matthew_luke]

Does Fortigate 100E have stateful connection for mutilple WAN connection? For my case, I have setup a server network which connected to two internet service provided by ISP A and ISP B though Fortigate 100E. When there is client access the server from ISP A, the server should able to return the traffic using WAN port which connected to ISP A, and When there is client access the server from ISP B, the server should able to return the traffic using WAN port which connected to ISP B, Can Fortigate Firewall able to support according to my requirement?

[ede_pfau]

hi,

and welcome to the forums.

Yes, the VIP/destination NAT which you use to publish your internal servers is stateful. Even if not, FortiOS would always try to lead return traffic back to the port it came in.

You need to have appropriate routes (that is, 2 equal default routes) in place, and of course policies allowing the traffic in.

[Matthew_luke]

Hi Since the destination NAT for server on ISP B will not configured on the Fortigate FW (will be configured on other FW which is installed in front of Fortigate FW), the destination NAT for server will only configured on Fortigate FW for ISP A, does default route with equal cost can achieve my requirment? Do I need to implement the FortiADC with reverse path route cache in order to achieve my requirment or Fortigate 100E include the reverse path route cache by default without FortiADC? Thanks

[ede_pfau]

Incoming traffic (NATted or not) will create a session if allowed. Part of the session state is the ingress port. FortiOS will try to send return traffic via the same (ingress) port.

So far the theory. As I have not got a dual-WAN setup at the moment I cannot confirm this. You will need two default routes in any case, with equal distances, otherwise ingress traffic may be dropped.

Maybe other forum members could comment on this, as seen in practice.

[Toshi_Esumi]

Besides, Fortigates regularly don't allow a session packet coming in one side and a return packet going back on the other side as "asymmetric route" unless you specifically configured to allow it.