Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
prince
New Contributor III

How do I configure multiple VLANs to access different WAN links?

Hi Support,

I am New to Fortinet firewall. we are using FortiGate 100F firewall and the firmware version is v7.4. we have created multiple Vlans and two WAN links. now I configured static route for wan links. and Now all the vlans network traffics are going in only one wan link ie (primary Link). the secondary wan link is idle. so i need to segregate  the Vlan traffic with the two WAN link. i need to configure One Vlan to access only Primary wan link. and second Vlan to access  secondary wan link.  and i have not configure the wan link in SD wan ZONE can you Please help. 

2 Solutions
srajeswaran
Staff
Staff

Can you enable ECMP for routes via WAN links and check? Make sure the routes via WAN1 and WAN2 are configured with same priority/distance.

# config system settings
       set v4-ecmp-mode source-dest-ip-based     
 
Regards,

Suraj

- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

View solution in original post

prince
New Contributor III

thanks you SRajeswaran, your solution solved my issue. when we check with Forti support toll free they informed they wont help for this initial configuration and by orally he informed to configure SD WAN for this issue. now as per your suggestion i just change the administrator distance and priority . it worked for me. thanks a lot.

View solution in original post

4 REPLIES 4
srajeswaran
Staff
Staff

Can you enable ECMP for routes via WAN links and check? Make sure the routes via WAN1 and WAN2 are configured with same priority/distance.

# config system settings
       set v4-ecmp-mode source-dest-ip-based     
 
Regards,

Suraj

- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

prince
New Contributor III

thanks you SRajeswaran, your solution solved my issue. when we check with Forti support toll free they informed they wont help for this initial configuration and by orally he informed to configure SD WAN for this issue. now as per your suggestion i just change the administrator distance and priority . it worked for me. thanks a lot.

srajeswaran

Thanks for the confirmation @prince ,glad to hear the issue is fixed.

Regards,

Suraj

- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

xsilver_FTNT
Staff
Staff

Hi,

if I got it correctly then you need to have several VLANs. You do have 2 WAN link connections. And you need to route traffic from specific VLAN to specific WAN link.
If that's the case, then I do see following options (from less to most config intensive):

 

1. Policy routes

- simply use that for a source IP Address + Incoming interface being your VLAN, and Outgoing interface option enabled and respective outgoing interface set.
- Via GUI in Network/Policy Routes , in CLI via 'config router policy' (simplified example):

config router policy
   edit 0
      set input-device "WLAN-11"
      set src "10.0.11.0/255.255.255.0"
      set dstaddr "all"
      set output-device "WAN-2"
   next
end

 

2. VRF

- separate interfaces by VRF ID and use that for routing between them
- more can be found in: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/224629/virtual-routing-and-f... 

 

3. SD-WAN

- use Software Defined WAN and policy based routing to have more complicated setup, however with benefits like link quality monitors and overflows between WAN interfaces if needed

- more on that in: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/19246/sd-wan 

 

Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff

Labels
Top Kudoed Authors