LAN users to WAN1 and Wifi to WAN2

[flybelgium]

Hello,

I have a Fortigate 100E and i would like to route internet traffic to 2 differents WAN. Actually, i have made this configuration and... not working :

1. In interfaces, i have my 2 WANS configured with the ISP ip config

2. In Static Routes, i have my 2 WANS configured with the gateway of my ISP. First with distance 10 and WAN 2 with distance 20.

3. In IPV4 Policy i have basicaly 2 policies :

--> 1 All LAN traffic to WAN1 source all - destination all with AV, Web Filter and AppControl and SSL Inspection.

--> 2 LAN Traffic with in source 2 Locales IP only 192.168.100.10 + 192.168.100.11> destination All to WAN 2

At this point all the traffic go to WAN1...

I have made a policy to DENY 192.168.100.10 and 192.168.100.11 to WAN1

At this point, this two ips are not working... no WAN traffic, in traceroute i dont have any responses, local network ok, no outgoing traffic to WAN2 or WAN1.

Important, WAN1 traffic go to CISCO Router and WAN2 Traffic is a cable modem in bridged mode. I just would like to route selected IP to WAN2 and the rest to WAN1, like servers to wan1 and users to wan2. Any idea ?

Thanks in advance.

[tanr]

Your static routes need to have the same distances, but different priorities, that way they will both stay in the routing table, but the route with the higher priority (lower number) will be used by default.

So, say you have created the route to WAN1 with the higher priority.

Create a policy route with, your WiFi users as the source, and specify WAN2 as the outgoing interface. 

The policy route will find the other route in your routing table and use it.

[flybelgium]

tanr wrote:

Your static routes need to have the same distances, but different priorities, that way they will both stay in the routing table, but the route with the higher priority (lower number) will be used by default.

So, say you have created the route to WAN1 with the higher priority.

Create a policy route with, your WiFi users as the source, and specify WAN2 as the outgoing interface. 

The policy route will find the other route in your routing table and use it.

Thanks tanr.

In my tests, i have deleted my static route to WAN2 and now, i cannot add a static route...

Destination 0.0.0.0/0.0.0.0 Gateway = ISP Gateway of WAN2 (for example 2.2.2.2) Interface WAN2 Administrative Distance = 10 Priority = 10

I have this error :

Error

A duplicate entry already exists.

I just have only one static route to WAN1

Destination 0.0.0.0/0.0.0.0 Gateway = ISP Gateway (1.1.1.1) Interface WAN1 Administrative Distance = 10 Priority = 5

If i look to routing monitor, i see a connected route to my WAN2... i dont find where is this connected route ?

Thanks in advance

[flybelgium]

I have found my error, it was on IP POOL, i have made a ip config for testing purpose in this menu... deleted and ok.

At this time, i have added a second static route with ISP Gateway WAN 1

Destination 0.0.0.0/0.0.0.0 Gateway = ISP Gateway of WAN1 (for example 1.1.1.1) Interface WAN2 Administrative Distance = 10 Priority = 10

WAN 2

Destination 0.0.0.0/0.0.0.0 Gateway = ISP Gateway of WAN2 (for example 2.2.2.2) Interface WAN2 Administrative Distance = 10 Priority = 5

I have made a policy for just my ip go to WAN2 for testing...

Not to bad... when i made traceroute, i can see my WAN2 after the fortigate but... all users on LAN interface

doesnt have WAN access to WAN1... strange... i think LAN users go through WAN2...  This is "not possible"... i dont have any rules to forward internet traffic to WAN2, only my rule with my ip :

Incoming : LAN interface

Outgoing : WAN2

Source : My Ip created in Adresses (my ip is in the lan interface range)

Destination : All

Service : All

and NAT activated.

I dont understand... Thanks in advance for help.

[tanr]

Priority 5 is considered "higher" than priority 10, so you've made WAN2 the higher priority route.

Just switch the priority values in your static routes.

[flybelgium]

tanr wrote:

Priority 5 is considered "higher" than priority 10, so you've made WAN2 the higher priority route.

Just switch the priority values in your static routes.

Thank you, i have understand 10 is higher than 5 ... sorry :)

When i made 5 priority to WAN2 and 10 to WAN1 all users doesnt have access to internet through 2 wans.

For me, this is a DNS problem, i can ping everything oustide, just resolution not working, but i dont know if is on the firewall or my network... ?

I have a DNS Server in my domain, i have added the 2 DNS Servers of my ISP in the server.

If i add 8.8.8.8 on my local network card > i can surf through WAN2

If i apply DHCP on my network card > i cannot surf on WAN2

I have apply two differents things for testing :

- My computer with a RJ45 Network (with Domain) > not working on WAN2

- Wifi Users with policy to go outside on WAN2 > OK Working >> in my firewall, Wifi Users are configured with own DHCP Server directy on SSID Profile with 8.8.8.8 for DNS.

If i made a simple network map :

My Local Computer >> Local DNS Domain >> Fortigate Firewall > Outside WAN1 or WAN2

[tanr]

If you can ping out from your wired network, and traceroute shows you going the proper route, then yes it sounds like just a DNS issue.  That is, assuming you have all the security policies in place to allow basic outbound traffic.

Does your local computer have the correct IP for your internal DNS server?  Does the FortiGate have security policies to let your internal DNS server access public DNS servers?

[rwpatterson]

DNS is funny. If you try to resolve on one ISP's network using another's DNS servers, it may not work. Try a neutral server like (blech) Google @ 8.8.8.8/8.8.4.4 or one of the Level3 boxes 4.2.2.[1-6], and see if results are different.

[fslomka]

What about using the SD-WAN feature?

Give WAN1 a priority of 254 and WAN2 a priority of 1

Then create a custom rule to pass certain traffic(ips) through WAN2

[pawanrohilla1984]

hi is it working now?