Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
DanieZ
New Contributor

Fortigate FG60D two WAN routing issue

God day.

 

Need help in configuring my fortigate with 2 WAN ports One network through port wan1 have office internet and mail server with VIPs second network through port WAN2 have wifi guest network The problem is that from WAN2 it is impossible go to WAN1 mail server OWA page.

WAN`s taken from one internet provider with different IP and have different distance, internet to WAN2 set up through Routing policy.

 

Can anyone help?

14 REPLIES 14
Ashik_Sheik
Contributor II

Hi ,

 

I have similar design . Explain with Eg:

 

                                ( Lan) interface Port 1 : 172.16.1.1/24

  ( Guest_Network_Subnet )Interface: Port2 : 10.10.10.1/24

                       WAN1 :100.100.100.1/24

OWA Server Ip :172.16.1.10/24 GW :172.16.1.1

OWA-VIP : External IP :100.100.100.10 --Internal:172.16.1.10 (OWA Server Real IP)

 

Now Policy :

 

Create a Destination NAT Policy for OWA from internet  : 

Incoming interface : WAN1

Sourse Sunet :All

Destination Interface :Port1(LAN)

Destination Subnet :OWA-VIP

Set Service :All

Set action :Allow 

NAT "Disbaled"

 

 

Create a  PolicyGuest to access OWA from Guest Network:

Incoming interface : Port2

Sourse Subnet :Guest-Network_Subnet

Destination Interface :Port1(LAN)

Destination Subnet :OWA-VIP

Set Service :All

Set action :Allow 

Nat :Disabled 

 

Hope this is clear.You just need U turn policy from guest network .

 

Regds

 

Ashik

 

Ashu 

 

Ashu
DanieZ

ashik wrote:

Hi ,

 

I have similar design . Explain with Eg:

 

                                ( Lan) interface Port 1 : 172.16.1.1/24

  ( Guest_Network_Subnet )Interface: Port2 : 10.10.10.1/24

                       WAN1 :100.100.100.1/24

OWA Server Ip :172.16.1.10/24 GW :172.16.1.1

OWA-VIP : External IP :100.100.100.10 --Internal:172.16.1.10 (OWA Server Real IP)

 

Now Policy :

 

Create a Destination NAT Policy for OWA from internet  : 

Incoming interface : WAN1

Sourse Sunet :All

Destination Interface :Port1(LAN)

Destination Subnet :OWA-VIP

Set Service :All

Set action :Allow 

NAT "Disbaled"

 

 

Create a  PolicyGuest to access OWA from Guest Network:

Incoming interface : Port2

Sourse Subnet :Guest-Network_Subnet

Destination Interface :Port1(LAN)

Destination Subnet :OWA-VIP

Set Service :All

Set action :Allow 

Nat :Disabled 

 

Hope this is clear.You just need U turn policy from guest network .

 

Regds

 

Ashik

 

Hi

I have a difference from your configuration, guest lan using physical WAN2 with another subnet.

According to your example, something like the following :

 

( Lan) interface Port 1 : 172.16.1.1/24

( Guest_Lan )Interface: Port2 : 10.10.10.1/24

                       WAN1 :100.100.100.1/29

                       WAN2 :100.200.200.1/29

OWA Server Ip :172.16.1.10/24 GW :172.16.1.1

OWA-VIP : External IP :100.100.100.10 --Internal:172.16.1.10 (OWA Server Real IP)

 

Static routes:

                       WAN1 :100.100.100.1/29 distance 10

                       WAN2 :100.200.200.1/29 distance 20

Routing policy

(guest lan) routed from Port2: 10.10.10.1/24 to WAN2 :  100.200.200.1/29

 

Ipv4 Policy :

 

Create a Destination NAT Policy for OWA from internet  : 

Incoming interface : WAN1

Sourse Sunet :All

Destination Interface :Port1(LAN)

Destination Subnet :OWA-VIP

Set Service :All

Set action :Allow 

NAT "Disbaled"

 

The decision that was proposed a really worked with only WAN1 for both subnets, but in my configuration I need something else.

Ashik_Sheik

Hi ,

 

You don't have to worry about WAN2 , coz traffic is internally routing between guest and lan network .Yes , may be you have policy route 0.0.0.0/0  from guest network  to reach WAN2 , this may affect your traffic to reach to LAN .

 

Just create a another policy route on top of 0,0.0.0/0 to LAN or Sever network and select stop policy route option .

Finally u need below policy only 

 

Create a  PolicyGuest to access OWA from Guest Network: Incoming interface : Port2 Sourse Subnet :Guest-Network_Subnet Destination Interface :Port1(LAN) Destination Subnet :OWA-VIP Set Service :All Set action :Allow  Nat :Disabled 

 

Hope you understood  the configuration . 

 

Regds,

 

Ashik

Ashu 

 

Ashu
DanieZ

ashik wrote:

Hi ,

 

You don't have to worry about WAN2 , coz traffic is internally routing between guest and lan network .Yes , may be you have policy route 0.0.0.0/0  from guest network  to reach WAN2 , this may affect your traffic to reach to LAN .

 

Just create a another policy route on top of 0,0.0.0/0 to LAN or Sever network and select stop policy route option .

Finally u need below policy only 

 

Create a  PolicyGuest to access OWA from Guest Network: Incoming interface : Port2 Sourse Subnet :Guest-Network_Subnet Destination Interface :Port1(LAN) Destination Subnet :OWA-VIP Set Service :All Set action :Allow  Nat :Disabled 

 

Hope you understood  the configuration . 

 

Regds,

 

Ashik

Bingo!!!!

Ashik - thanks for the help! everything is works

 

The main problem was in understanding that traffic in my case would go locally

Fullmoon

DanieZ wrote:

ashik wrote:

                                ( Lan) interface Port 1 : 172.16.1.1/24

  ( Guest_Network_Subnet )Interface: Port2 : 10.10.10.1/24

                       WAN1 :100.100.100.1/24

OWA Server Ip :172.16.1.10/24 GW :172.16.1.1

OWA-VIP : External IP :100.100.100.10 --Internal:172.16.1.10 (OWA Server Real IP)

 

Now Policy :

 

Create a Destination NAT Policy for OWA from internet  : 

Incoming interface : WAN1

Sourse Sunet :All

Destination Interface :Port1(LAN)

Destination Subnet :OWA-VIP

Set Service :All

Set action :Allow 

NAT "Disbaled"

 

 

Create a  PolicyGuest to access OWA from Guest Network:

Incoming interface : Port2

Sourse Subnet :Guest-Network_Subnet

Destination Interface :Port1(LAN)

Destination Subnet :OWA-VIP

Set Service :All

Set action :Allow 

Nat :Disabled 

 

Hope this is clear.You just need U turn policy from guest network .

 

Regds

 

Ashik

 

Hi

I have a difference from your configuration, guest lan using physical WAN2 with another subnet.

According to your example, something like the following :

 

( Lan) interface Port 1 : 172.16.1.1/24

( Guest_Lan )Interface: Port2 : 10.10.10.1/24

                       WAN1 :100.100.100.1/29

                       WAN2 :100.200.200.1/29

OWA Server Ip :172.16.1.10/24 GW :172.16.1.1

OWA-VIP : External IP :100.100.100.10 --Internal:172.16.1.10 (OWA Server Real IP)

 

Static routes:

                       WAN1 :100.100.100.1/29 distance 10

                       WAN2 :100.200.200.1/29 distance 20

Routing policy

(guest lan) routed from Port2: 10.10.10.1/24 to WAN2 :  100.200.200.1/29

 

Ipv4 Policy :

 

Create a Destination NAT Policy for OWA from internet  : 

Incoming interface : WAN1

Sourse Sunet :All

Destination Interface :Port1(LAN)

Destination Subnet :OWA-VIP

Set Service :All

Set action :Allow 

NAT "Disbaled"

 

 

We often called this one as hair pinning. Kindly try this approach.

Static routes:

                       WAN1 :100.100.100.1/29 distance 10

                       WAN2 :100.200.200.1/29 distance 10

 

Policy Route (often called as PBR)

Policy 1 

input-device : "port2" src : "10.10.1.0/255.255.255.0" dst : "100.100.100.10/255.255.255.255" "172.16.1.10/255.255.255.255"

action : deny 

status : enable 

 

Policy 2

input-device : "port2"

src : "10.10.1.0/255.255.255.0" action : permit protocol : 0 gateway : 0.0.0.0 output-device : WAN2

 

DNAT Rule

Incoming interface : WAN1

Source Subnet :All

Destination Interface :Port1(LAN)

Destination Subnet :OWA-VIP

Set Service :All

Set action :Allow 

NAT "Disbaled"

 

Fortigate Newbie

Fortigate Newbie
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors