- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Load balance 2 WAN provider using each available IP block
We have a current SD WAN setup with LAN internet connectivity traffics load balanced to 2 ISP providers - both WAN interface IPs are used and the bandwidths are combined.
- 192.168.0.0/24 --> ISP-A-50Mb (1.1.1.1/29) + ISP-B-50Mb (2.2.2.1/29)
- Both IPs are used randomly in each session even in a single device
- Bandwidths are combined to 100Mbps
This time I would like to use the other available IPs from each ISP block then still have the bandwidth combined and load balance from a diff LAN subnet.
- 192.168.10.0/24 --> ISP-A-50Mb (1.1.1.2/29) + ISP-B-50Mb (2.2.2.2/29)
Attempt: Assign overload IP pool for each ISP, and setup an outbound firewall policy NAT to it.
- Only single IP (random) is used per device
- Only single ISP bandwidth is utilized - 50Mbps
Solved! Go to Solution.
- Labels:
-
FortiGate
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OK today I learned that fast.com uses multiple sesssions and servers to conduct a speed test. This makes sense why it would be combined across both wan links then!
So currently you have one FW policy that works and you have another FW policy referencing a different LAN subnet and using different IP pools that does not work in terms of load balancing? Is that correct?
Have you tried splitting the FW policies for the different LAN subnet for each ISP/pool?
Graham
- « Previous
-
- 1
- 2
- Next »
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What version of FOS are you on?
Do you have any rules or services in your SDWAN config? Is there more under your 'config system sdwan' configuration?
Can you try changing the LB method to "source-dest-ip-based"?
Can you further explain the behaviour you are seeing with regards to LAN users using only single IP (random) per device? How is it random? Based on your config they should only be getting one IP from the pool that is linked to that ISP.
Next thing we could try is splitting the FW policy into two. One for upg-zone-wan1 and one for upg-zone-wan2 with associated pools, etc.
Graham
Created on ‎04-23-2023 10:32 PM Edited on ‎04-23-2023 10:33 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
With the current setup:
- 192.168.0.0/24 --> ISP-A-50Mb (1.1.1.1/29) + ISP-B-50Mb (2.2.2.1/29)
- Both IPs are used
- In a single device, when check for public IP : for instance, ipchicken see 1.1.1.1 and ipcow see 2.2.2.1
- Bandwidths are combined to 100Mbps
- When speedtest
- Both IPs are used
This is the target behavior I am expecting.
However after setting FW policy with NAT IP Pools, below are the results:
- 192.168.10.0/24 --> ISP-A-50Mb (1.1.1.2/29) + ISP-B-50Mb (2.2.2.2/29)
- Only single IP (random) is used per device
- In a single device, when check for public IP, regardless of how many iplocation sites I use, it only gets 1.1.1.2. Random like, another device is only 2.2.2.2.
- Only single ISP bandwidth is utilized - 50Mbs
- When speedtest
- Only single IP (random) is used per device
Having said those, I believe "changing the LB method to source-dest-ip-based" & "splitting the FW policy into two" - please correct me if I'm wrong, wont meet the load balancing I need base on the current setup.
I am in v7.2.3
The reset of sdwan config are the ff:
config health-check
edit "ISP1_GW_PERF"
set server "1.1.1.254"
set members 1
config sla
edit 1
set latency-threshold 50
set jitter-threshold 50
set packetloss-threshold 10
next
end
next
edit "ISP2_GW_PERF"
set server "2.2.2.254"
set members 2
config sla
edit 1
set latency-threshold 50
set jitter-threshold 50
set packetloss-threshold 10
next
end
next
end
config service
edit 1
set name "ISP1_ISP2_WAN"
set mode load-balance
set dst "all"
set src "all"
config sla
edit "ISP1_GW_PERF"
set id 1
next
edit "ISP2_GW_PERF"
set id 1
next
end
set priority-members 1 2
next
end
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Graham
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What do you see in the SD-WAN Zones configuration on your FGT in terms of bw utilization on each link?
It manages to have a balance load. This is in the actual infra using the first scenario sdwan config - boxed usage when did the speedtest:
Each link had 200 bandwidth. Got the speedtest result below with actual usage.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OK today I learned that fast.com uses multiple sesssions and servers to conduct a speed test. This makes sense why it would be combined across both wan links then!
So currently you have one FW policy that works and you have another FW policy referencing a different LAN subnet and using different IP pools that does not work in terms of load balancing? Is that correct?
Have you tried splitting the FW policies for the different LAN subnet for each ISP/pool?
Graham
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Great! Splitting policies did it. Both IPs being used and bandwidth on speedtest are combined now. Thank you very much Graham.

- « Previous
-
- 1
- 2
- Next »