How traffic rules works if I have 2 WAN Links

[Nihas]

I have a basic doubt!! I have 3 WAN links and I would like to use all these 3 WAN links for separate VLAN groups. VLAN 10 - 10.128.10.0/24 --- WAN1 VLAN 20 - 10.128.20.0/24---- WAN2 VLAN 30 - 10.128.30.0/24 ----WAN3 If I create policies like below for all subnets with different wan int , I believe it will pass the traffic for the respective subnets through the respective WAN interface. But what will happen for the other subnets ? Will the Device drop the connections or will it find the respective policies in the firewall and does the re routing?? Src Interface - internal Src Add - 10.128.10.0/24 Dest - 0.0.0.0/0.0.0.0 Dest interface - WAN1 Src Interface - internal Src Add - 10.128.20.0/24 Dest - 0.0.0.0/0.0.0.0 Dest interface - WAN2 Here what will happen if 10.128.20.121( machine) try to connect internet through WAN1 ? ( If there is no policy route in place) I know we can enforce the networks traffic through a specific int with the help of policy route, But Is there any other way to enforce the network through a specific interface?

[oscarcamacho]

Hi Nihas, The way FortiGate works is that routing decisions are taken prior firewall policies are matched, so you must use policy routes to define which wan link should each lan use. If you just set all static routes with same distance and priority the FortiGate wil try to balance the traffic, so if the router layer sends the traffic for the first vlan through the wan2 and there is no policy defined for that, then it will match the implicit deny policy. Be careful when using policy routes, as they are checked before static and connected routes, so if you define one with destination 0.0.0.0/0 it will match ALL the traffic, you must specified first rules for all other networks that you need to communicate.

[Nihas]

Thanks Oscar Camacho :) Really Nice explanation. So how would be scenario, if I need redundancy also? For example, What will happen if 10.128.20.121( machine) try to connect internet through WAN1 , but if the link is down ? ( policy route in place for enforcing the client to pass all traffic through WAN1) Assumption * I have created ECMP , gateway detection etc. * I have created redundant firewall policy under LAN--> WAN2 for VLAN 10 users as well. ---------------------------------- In this case will it redirect the traffic through available interfaces? or Do I need to create a second policy route with WAN 2 for redundancy?

[oscarcamacho]

Hi Nihas, You should always keep in mind that router layer decides where the traffic is send, and firewall determines if it has permission. The router layer first checks policy routes in the order presented and then static routes. Policy routes can have fallback policies, for example the first one for lan1 through wan1 and a second one for lan1 through wan2, if wan1 is up the traffic will always match the first rule, if wan1 is down (physically disconnected or detected by dead gateway detection) then the rules with that outgoing interface will be ignored and the second rule will be matched. Also if no other policy route is matched then the router will use a static route based on best-match. This way is how you handle redundancy with routing. On the firewall side you just need to have the right policies to eventually match that traffic, you could use Zones for all the wan links a single Internet destination and handle the traffic distribution and redundancy on the router layer, or you could use different sets of permissions so when the backup link is in use you could block things like streaming if it' s a low bandwidth connection. Example: You have 3 wan links, you want to load balanced links 1 and 2 using ECMP with regular static routes, all your company traffic is send through this two and the 3rd link has a route with higher priority so it works as a backup. But you also want to use that 3rd connection for guest access, so you could use a policy route for that exception. Assuming dead gateway detection is properly configured and you have only that policy route, if links 1 and 2 are down then all traffic will use the 3rd link because of the backup static route, or if link 3 is down then the guest access traffic will use the balanced routes on 1 and 2 because the policy route was ignored and it fallbacks to the static routes. But it doesn' t mean that this is going to be allowed by the firewall, the policies could use a zone for 1 and 2, so company traffic has full access on this zone, but limited access on wan3, and guest access traffic has full access on wan3 but no access to the 1 and 2 zone. Hope I explain it well and didn' t confuse you ;)

[Nihas]

Yes Buddy..:) Thanks !