How do I configure multiple VLANs to access different WAN links?

[prince]

Hi Support,

I am New to Fortinet firewall. we are using FortiGate 100F firewall and the firmware version is v7.4. we have created multiple Vlans and two WAN links. now I configured static route for wan links. and Now all the vlans network traffics are going in only one wan link ie (primary Link). the secondary wan link is idle. so i need to segregate  the Vlan traffic with the two WAN link. i need to configure One Vlan to access only Primary wan link. and second Vlan to access  secondary wan link.  and i have not configure the wan link in SD wan ZONE can you Please help. 

[srajeswaran · Accepted solution]

Can you enable ECMP for routes via WAN links and check? Make sure the routes via WAN1 and WAN2 are configured with same priority/distance.

# config system settings

       set v4-ecmp-mode source-dest-ip-based     

Ref: https://community.fortinet.com/t5/FortiGate/Technical-Tip-ECMP-Load-balancing-algorithms-for-IPv4-an...

[srajeswaran · Accepted solution]

Can you enable ECMP for routes via WAN links and check? Make sure the routes via WAN1 and WAN2 are configured with same priority/distance.

# config system settings

       set v4-ecmp-mode source-dest-ip-based     

Ref: https://community.fortinet.com/t5/FortiGate/Technical-Tip-ECMP-Load-balancing-algorithms-for-IPv4-an...

[prince · Accepted solution]

thanks you SRajeswaran, your solution solved my issue. when we check with Forti support toll free they informed they wont help for this initial configuration and by orally he informed to configure SD WAN for this issue. now as per your suggestion i just change the administrator distance and priority . it worked for me. thanks a lot.

[srajeswaran]

Thanks for the confirmation @prince ,glad to hear the issue is fixed.

[xsilver_FTNT]

Hi,

if I got it correctly then you need to have several VLANs. You do have 2 WAN link connections. And you need to route traffic from specific VLAN to specific WAN link.
If that's the case, then I do see following options (from less to most config intensive):

1. Policy routes

- simply use that for a source IP Address + Incoming interface being your VLAN, and Outgoing interface option enabled and respective outgoing interface set.
- Via GUI in Network/Policy Routes , in CLI via 'config router policy' (simplified example):

config router policy
   edit 0
      set input-device "WLAN-11"
      set src "10.0.11.0/255.255.255.0"
      set dstaddr "all"
      set output-device "WAN-2"
   next
end

2. VRF

- separate interfaces by VRF ID and use that for routing between them
- more can be found in: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/224629/virtual-routing-and-f... 

3. SD-WAN

- use Software Defined WAN and policy based routing to have more complicated setup, however with benefits like link quality monitors and overflows between WAN interfaces if needed

- more on that in: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/19246/sd-wan