Fortigate FG60D two WAN routing issue

[DanieZ]

God day.

Need help in configuring my fortigate with 2 WAN ports One network through port wan1 have office internet and mail server with VIPs second network through port WAN2 have wifi guest network The problem is that from WAN2 it is impossible go to WAN1 mail server OWA page.

WAN`s taken from one internet provider with different IP and have different distance, internet to WAN2 set up through Routing policy.

Can anyone help?

[Ashik_Sheik]

Hi ,

I have similar design . Explain with Eg:

                                ( Lan) interface Port 1 : 172.16.1.1/24

  ( Guest_Network_Subnet )Interface: Port2 : 10.10.10.1/24

                       WAN1 :100.100.100.1/24

OWA Server Ip :172.16.1.10/24 GW :172.16.1.1

OWA-VIP : External IP :100.100.100.10 --Internal:172.16.1.10 (OWA Server Real IP)

Now Policy :

Create a Destination NAT Policy for OWA from internet  : 

Incoming interface : WAN1

Sourse Sunet :All

Destination Interface :Port1(LAN)

Destination Subnet :OWA-VIP

Set Service :All

Set action :Allow 

NAT "Disbaled"

Create a  PolicyGuest to access OWA from Guest Network:

Incoming interface : Port2

Sourse Subnet :Guest-Network_Subnet

Destination Interface :Port1(LAN)

Destination Subnet :OWA-VIP

Set Service :All

Set action :Allow 

Nat :Disabled 

Hope this is clear.You just need U turn policy from guest network .

Regds

Ashik

[DanieZ]

ashik wrote:

Hi ,

I have similar design . Explain with Eg:

                                ( Lan) interface Port 1 : 172.16.1.1/24

  ( Guest_Network_Subnet )Interface: Port2 : 10.10.10.1/24

                       WAN1 :100.100.100.1/24

OWA Server Ip :172.16.1.10/24 GW :172.16.1.1

OWA-VIP : External IP :100.100.100.10 --Internal:172.16.1.10 (OWA Server Real IP)

Now Policy :

Create a Destination NAT Policy for OWA from internet  : 

Incoming interface : WAN1

Sourse Sunet :All

Destination Interface :Port1(LAN)

Destination Subnet :OWA-VIP

Set Service :All

Set action :Allow 

NAT "Disbaled"

Create a  PolicyGuest to access OWA from Guest Network:

Incoming interface : Port2

Sourse Subnet :Guest-Network_Subnet

Destination Interface :Port1(LAN)

Destination Subnet :OWA-VIP

Set Service :All

Set action :Allow 

Nat :Disabled 

Hope this is clear.You just need U turn policy from guest network .

Regds

Ashik

Hi

I have a difference from your configuration, guest lan using physical WAN2 with another subnet.

According to your example, something like the following :

( Lan) interface Port 1 : 172.16.1.1/24

( Guest_Lan )Interface: Port2 : 10.10.10.1/24

                       WAN1 :100.100.100.1/29

                       WAN2 :100.200.200.1/29

OWA Server Ip :172.16.1.10/24 GW :172.16.1.1

OWA-VIP : External IP :100.100.100.10 --Internal:172.16.1.10 (OWA Server Real IP)

Static routes:

                       WAN1 :100.100.100.1/29 distance 10

                       WAN2 :100.200.200.1/29 distance 20

Routing policy

(guest lan) routed from Port2: 10.10.10.1/24 to WAN2 :  100.200.200.1/29

Ipv4 Policy :

Create a Destination NAT Policy for OWA from internet  : 

Incoming interface : WAN1

Sourse Sunet :All

Destination Interface :Port1(LAN)

Destination Subnet :OWA-VIP

Set Service :All

Set action :Allow 

NAT "Disbaled"

The decision that was proposed a really worked with only WAN1 for both subnets, but in my configuration I need something else.

[Ashik_Sheik]

Hi ,

You don't have to worry about WAN2 , coz traffic is internally routing between guest and lan network .Yes , may be you have policy route 0.0.0.0/0  from guest network  to reach WAN2 , this may affect your traffic to reach to LAN .

Just create a another policy route on top of 0,0.0.0/0 to LAN or Sever network and select stop policy route option .

Finally u need below policy only 

Create a  PolicyGuest to access OWA from Guest Network: Incoming interface : Port2 Sourse Subnet :Guest-Network_Subnet Destination Interface :Port1(LAN) Destination Subnet :OWA-VIP Set Service :All Set action :Allow  Nat :Disabled 

Hope you understood  the configuration . 

Regds,

Ashik

[DanieZ]

ashik wrote:

Hi ,

You don't have to worry about WAN2 , coz traffic is internally routing between guest and lan network .Yes , may be you have policy route 0.0.0.0/0  from guest network  to reach WAN2 , this may affect your traffic to reach to LAN .

Just create a another policy route on top of 0,0.0.0/0 to LAN or Sever network and select stop policy route option .

Finally u need below policy only 

Create a  PolicyGuest to access OWA from Guest Network: Incoming interface : Port2 Sourse Subnet :Guest-Network_Subnet Destination Interface :Port1(LAN) Destination Subnet :OWA-VIP Set Service :All Set action :Allow  Nat :Disabled 

Hope you understood  the configuration . 

Regds,

Ashik

Bingo!!!!

Ashik - thanks for the help! everything is works

The main problem was in understanding that traffic in my case would go locally

[Fullmoon]

DanieZ wrote:

ashik wrote:

                                ( Lan) interface Port 1 : 172.16.1.1/24

  ( Guest_Network_Subnet )Interface: Port2 : 10.10.10.1/24

                       WAN1 :100.100.100.1/24

OWA Server Ip :172.16.1.10/24 GW :172.16.1.1

OWA-VIP : External IP :100.100.100.10 --Internal:172.16.1.10 (OWA Server Real IP)

Now Policy :

Create a Destination NAT Policy for OWA from internet  : 

Incoming interface : WAN1

Sourse Sunet :All

Destination Interface :Port1(LAN)

Destination Subnet :OWA-VIP

Set Service :All

Set action :Allow 

NAT "Disbaled"

Create a  PolicyGuest to access OWA from Guest Network:

Incoming interface : Port2

Sourse Subnet :Guest-Network_Subnet

Destination Interface :Port1(LAN)

Destination Subnet :OWA-VIP

Set Service :All

Set action :Allow 

Nat :Disabled 

Hope this is clear.You just need U turn policy from guest network .

Regds

Ashik

Hi

I have a difference from your configuration, guest lan using physical WAN2 with another subnet.

According to your example, something like the following :

( Lan) interface Port 1 : 172.16.1.1/24

( Guest_Lan )Interface: Port2 : 10.10.10.1/24

                       WAN1 :100.100.100.1/29

                       WAN2 :100.200.200.1/29

OWA Server Ip :172.16.1.10/24 GW :172.16.1.1

OWA-VIP : External IP :100.100.100.10 --Internal:172.16.1.10 (OWA Server Real IP)

Static routes:

                       WAN1 :100.100.100.1/29 distance 10

                       WAN2 :100.200.200.1/29 distance 20

Routing policy

(guest lan) routed from Port2: 10.10.10.1/24 to WAN2 :  100.200.200.1/29

Ipv4 Policy :

Create a Destination NAT Policy for OWA from internet  : 

Incoming interface : WAN1

Sourse Sunet :All

Destination Interface :Port1(LAN)

Destination Subnet :OWA-VIP

Set Service :All

Set action :Allow 

NAT "Disbaled"

We often called this one as hair pinning. Kindly try this approach.

Static routes:

                       WAN1 :100.100.100.1/29 distance 10

                       WAN2 :100.200.200.1/29 distance 10

Policy Route (often called as PBR)

Policy 1 

input-device : "port2" src : "10.10.1.0/255.255.255.0" dst : "100.100.100.10/255.255.255.255" "172.16.1.10/255.255.255.255"

action : deny 

status : enable 

Policy 2

input-device : "port2"

src : "10.10.1.0/255.255.255.0" action : permit protocol : 0 gateway : 0.0.0.0 output-device : WAN2

DNAT Rule

Incoming interface : WAN1

Source Subnet :All

Destination Interface :Port1(LAN)

Destination Subnet :OWA-VIP

Set Service :All

Set action :Allow 

NAT "Disbaled"