How to Direct Specific Traffic to Specific WAN?

alzaiem · ‎02-27-2018

Hello Everyone,

We have FortiGate 140D with OS 5.6 . We are currently depending on WAN1 port to access the internet which is microwave link. I have a new 4G device, which i would like to connect to FortiGate WAN2 but use it only for windows update downloads. I tried to connect the 4G link to WAN2 port, then suddenly all internet is disconnected from the users !! How can I use WAN2 just only for update of software?? even if its down, i don't want this traffic to go to WAN1.

Best Regards,

Alzaiem

Jeff_Roback · ‎05-21-2018

This is a surprisingly complex topic. Here's a KB article I put together for our internal staff on the subject that explains this from a conceptual standpoint:

Setting up fortinet Fortigate firewalls for dual wan scenarios with >=2 Internet Connections

General strategy for setup:

Static default route for each wan interface[/ol][ul]same distance for each routedifferent priority for each route (lower priority wins)[/ul]

[ul]2. Link health monitor for each route. [ul]

This is what allows the route to be removed from the routing table if the link is unusable.

This route gets removed from routing table if the IP's given here aren't reachable.[/ul][/ul]

3. Policy Route for traffic that should use the secondary interface (the one Higher priority)

[ul]

MUST leave default gateway as 0.0.0.0

This allows it to be removed if that interface goes down.[/ul]

Routes specify where to send traffic.

This will generally be an interface (wan1, wan2, lan, etc) or a VPN tunnel to a remote site.

the VPN appears as a virtual interface just like an internet connection.

Routing Notes:

Each Policy route is inspected. As soon as one matches it wins and traffic goes that way

If a policy route refers to an interface that is down (via the link health monitor) then it will be skipped.[/ol]

If no policy route matches, then inspect each Static route, going from the lowest priority up.as soon as traffic matches, it goes that way.[/ol][/ol]

Note: If you need certain traffic to skip the priority routes, (for example forcing certain IP's to use the primary route even though there's a policy route to send that subnet via the secondary route), you can put an entry HIGHER in the list of policy routes for the IP(s) that stays "stop policy routing"

Policies specify what is done to the traffic as it passes this interfaceCheck if traffic is allowed to passby Source address, dest address, or port[/ol]

What inspection should be done on that traffic AV, Website Blocking[/ol]

NAT of the source IP address (sNAT)Changing the private 10.x.x.x address to a public IP address.[/ol][/ol][/ol]

DIRECTION of traffic from the fortigate's perspective is important to understand:

In general, keep in mind that with the FortiGate we are always thinking of traffic in terms of where the traffic first originated (ie which machine asked for the traffic).

When an end user is watching a youtube video, that is controlled by a policy from LAN to WAN.the fortigate catches the outbound request for the traffic from the user and automatically associates all the inbound traffic from wan to lan with that original session.

No settings are needed for WAN to LAN for this traffic, even though most of the traffic is flowing from the Internet to the user, it is considered LAN to WAN traffic.

Note this uses the sNAT indicated in the WAN to LAN policy to change the source address of the traffic to appear to be coming from a public adress. the IP Pool selected in the policy does this[/ol][/ol][/ol]

When someone on the Internet connect to the exchange server, this is controlled by a policy from WAN to LAN.The fortigate catches the inbound request from WAN to LAN and automatically allows returning traffic from the server back to the itnernet client.

Even though most of the traffic will be going from the email server (LAN) to the client (WAN), this is considered a WAN to LAN flow, since it was initiated on the WAN.

In this case, the DESTINATION IP is changed ( the public IP used by the client on the itnternet is mapped to the private IP of the email server using a Virtual IP.)this is controlled by the VIrtual IP.[/ol][/ol][/ol]

Servers that also initiate traffic to the internet and need to use a specific public IP address (Like email servers sending SMTP messages out) also need to be set up like clients, so they will also have their own LAN to WAN policy rule with a dedicated IP address (Using a IP Pool).[/ol]

Jeff Roback

View solution in original post

S1nDr3am · ‎02-27-2018

Hi, I think you should be able to achieve this using policy route. Make 1 policy using the windows update servers as destination then config WAN2 as the gateway. After that create a second policy and have so traffic use WAN1 as the gateway. Policy route is processed by sequence so I think this should work. Good luck

loic · ‎02-27-2018

you can use SD Wan and a SD Wan rules with the "Microsoft-MS.Update" internet services

more details for sdwan : http://cookbook.fortinet....net-basic-failover-56/

Loïc

alzaiem · ‎02-27-2018

Thank you S1nDr3am, Loic for the advice. I will go through it and see what happens.

Best Regards,

Alzaiem

Jeff_Roback · ‎05-21-2018