Fortigate WAN settings

[fred339]

This is a Fortigate 80F in mid-stages of configuration.

In Network/Interfaces, I see:

LAN(1) Internal Hardware Switch    Type Hardware Switch  Members Internal-1>Internal-6 

Internal-1 has an IP/Netmask which I presume applies to 1-6.

WAN(2) has

FGWAN1(wan1)  Physical Interface with an IP address

wan1                     Physical interface with 00.0.0./0.0.0.0

Now, I am planning to set up a 2nd WAN interface but not yet.

In the meantime, I want to set up an EXTERNAL ZONE with wan1 and wan2 but only wan2 is available it seems.   <<<So that's really the issue.

In the end, I should think there would be:

wan1 with an IP address

wan2 with a separate IP address

and an EXTERNAL ZONE with both of them in the zone.

[vsahu · Accepted solution]

Hello Fred,

Go to Network >> Interface and click on the reference number for wan 1

You'll be able to see something like below, once you select the object you'll be able to edit and delete it. In this config because of firewall policy is using port1 I was not able to create a zone with port1.

In your scenario just match the same reference between wan1 and wan2, and once you delete the reference which is causing this behavior you'll be able to call the interface in the zone. Generally it always firewall policy.

[Toshi_Esumi]

Probably because the default policy #1 is using wan1 already. Just remove the policy.

Toshi

[fred339]

I don't find anything like that.....

[Toshi_Esumi]

That's very unusual if you've gotten a brand-new 80F and started configuring it at the first time. Are you sure Policy & Objects->Firewall Policy is empty? Or none of them you created is using wan1?

Then what do you see at the end of row "wan1" under Network->interfaces page? There should be "Ref." column showing the number of references. Is it '0'? I'm almost sure it's NOT '0'.

Toshi

[fred339]

It's not brand-new.  

Thanks for the pointers re: how to find this.

In Network/Interfaces I see "3" under Ref. for wan1
If I open the "3", then I see 3 entries each with Ref = 0 and no more information there.
So, I feel like I'm getting somewhere but haven't arrived yet.

Thanks!

..I do have an IP assigned to wan1 but that wouldn't seem to me to affect Zone definition.

Would it?

[vsahu · Accepted solution]

Hello Fred,

Go to Network >> Interface and click on the reference number for wan 1

You'll be able to see something like below, once you select the object you'll be able to edit and delete it. In this config because of firewall policy is using port1 I was not able to create a zone with port1.

In your scenario just match the same reference between wan1 and wan2, and once you delete the reference which is causing this behavior you'll be able to call the interface in the zone. Generally it always firewall policy.

[Toshi_Esumi · Accepted solution]

Most likely your usage of wan1 is the same with Vishal's. At least one policy is using it with a default static route or more. Zone can be used only in policies, not for routing. So if you don't see wan1 in the candidate of the members of a zone, it has to be a policy or policies using it.

As Vishal's screen shot, the number on the policy after the name (DNS) is the policy ID. You can find it after you add "ID" in the table setting of Firewall policy page.

Or, if you've chosen (it's by default) Interface Pair View in the policy page, you should see "wan1" is in the interface pairs.

Toshi

[ede_pfau]

and the other 2 references would likely be

- a static (default) route (Network - Static route)

- a DHCP server (Network - interface - DHCP server)

The numbers in the "Ref." column are links, i.e. clickable. Follow the links to see which objects they are linked to.