ImPossible to use Fortigate as Load Balancer ? - Two ISP VirtualIP to same Internal server

[Potato]

Hi all,

I know Fortigate supports LB for single ISP to multiple Web servers... No need to tell me again. I don't want this.

I am studying Fortigate 6.0.6, DNAT and SDWAN whether able to perform the inbound traffic load balancing over two ISPs.

Let have a look at my Virtual IP configurations:

edit "Test1"
 set extintf "wan1"
 set portforward enable
 set mappedip "192.168.1.106"
 set extport 80
 set mappedport 80
 next

edit "Test2"
set extintf "wan2"
set portforward enable
set mappedip "192.168.1.106"
set extport 80
set mappedport 80
next

Both Wan1 and 2 are DHCP with external DDNS working well.

And are in SDWAN group already:

config system virtual-wan-link set status enable set load-balance-mode source-dest-ip-based config members edit 1 set interface "wan1" next edit 2 set interface "wan2" next end

Well, then I run a test from the Internet to wan2 to trigger the incoming traffic.

I find that about 50% chance the incoming does come from wan2, but the return traffic is to wan1.....

Or, Vice Versa.

The dia sni pac any "host MyTestDeviceSrcIpFromInternetToMyWan2" does appear:

Wan2 in : MyTestDeviceSrcIpFromInternetToMyWan2 -> Wan2:80

DMZ Out : MyTestDeviceSrcIpFromInternetToMyWan2 -> 192.168.1.106:80

DMZ In : 192.168.1.106:80 -> MyTestDeviceSrcIpFromInternetToMyWan2 Wan1 Out : Wan2 Interface IP as Src IP :80 -> MyTestDeviceSrcIpFromInternetToMyWan2  Obviously wrong route interface in the final step .... How does my Wan1 ISP accept the Wan2 Src IP traffic?

Of course not and get a drop!

The only way for me to make it able to in/out from wan2 is to have a SDWAN rule to force the server use WAN2. But this just stop me using the Wan1 for the same server incoming traffic at the same time.

Any solution?

[lobstercreed]

Hmm, this sounds like it could be a bug to me, but I have three ideas that you could test independently to see what works. 

[ol]

What happens if you set the nat-source-vip for each object to enable?

I would disable port-forwarding for these VIPs unless you have other services listening on your public IPs. Your policy from sdwan -> dmz should be used to restrict what ports the outside world can connect on.  Port forwarding is only desirable when multiple services need to be hosted on the same IP or when a non-standard port is used on one side or the other.

What if you actually set the extip to the addresses your ISP has given you?  I understand they're subject to change but it would be good to see if that's the issue...I found an article from very old code that shows you being on the right track, but the extip was set: https://kb.fortinet.com/kb/documentLink.do?externalID=FD30903[/ol]

Also, I would note that your title is misleading as it's not really load-balancing in any sense since you're pointing to one server...load-balancing is a separate feature that I assume you know about based on your comment at the beginning.

[Potato]

lobstercreed wrote:

Hmm, this sounds like it could be a bug to me, but I have three ideas that you could test independently to see what works. 

[ol]

What happens if you set the nat-source-vip for each object to enable?

I would disable port-forwarding for these VIPs unless you have other services listening on your public IPs. Your policy from sdwan -> dmz should be used to restrict what ports the outside world can connect on.  Port forwarding is only desirable when multiple services need to be hosted on the same IP or when a non-standard port is used on one side or the other.

What if you actually set the extip to the addresses your ISP has given you?  I understand they're subject to change but it would be good to see if that's the issue...I found an article from very old code that shows you being on the right track, but the extip was set: https://kb.fortinet.com/kb/documentLink.do?externalID=FD30903[/ol]

Also, I would note that your title is misleading as it's not really load-balancing in any sense since you're pointing to one server...load-balancing is a separate feature that I assume you know about based on your comment at the beginning.

1. Might I have more details and operation theory on the "nat-source-vip"? Can I server still able to see the source IP from the real WAN IP address but not the Fortigate? 2&3. Well, actually in my case, I have two static Real WAN mapping IP to one server for public access.. For your mentioned "Load-Balancing", ~ well. In my opinion, actually, I have a domain A record mapped with two WAN IP addresses already. But No going to discuss how to handle if one of the wan link down then what is going gon first. So, might be a little LB from WAN to it, I think? Anyway, thanks for your help.

[Potato]

lobstercreed wrote:

Hmm, this sounds like it could be a bug to me, but I have three ideas that you could test independently to see what works. 

[ol]

What happens if you set the nat-source-vip for each object to enable?

I would disable port-forwarding for these VIPs unless you have other services listening on your public IPs. Your policy from sdwan -> dmz should be used to restrict what ports the outside world can connect on.  Port forwarding is only desirable when multiple services need to be hosted on the same IP or when a non-standard port is used on one side or the other.

What if you actually set the extip to the addresses your ISP has given you?  I understand they're subject to change but it would be good to see if that's the issue...I found an article from very old code that shows you being on the right track, but the extip was set: https://kb.fortinet.com/kb/documentLink.do?externalID=FD30903[/ol]

Also, I would note that your title is misleading as it's not really load-balancing in any sense since you're pointing to one server...load-balancing is a separate feature that I assume you know about based on your comment at the beginning.

nat-source-vip >>> SAME ISSUE