More than 2 WAN-Links?

[tim_frodermann]

Hi, I have a question on how to use multiple WAN Links on a Fortigate unit. I would like to hear how you do it, generally. Fortigate units have two WAN ports. I am using these both with a lot of customers either for separating traffic via policy routing or for failover or for both at the same time. Now I have some customers in areas where they are not able to get a 50Mbit line but rather 5x 10Mbit lines. What are the options to use more than two WAN-Links with one unit? Given the background that it is not pppoe but rather separate provider routers as gateways. Can I utilize LAN Ports as WAN Ports ore something like that? Thank for your ideas! Bye, Tim

[Carl_Wallmark]

Hi Tim, All ports can be either LAN, WAN or DMZ they dont have any differences except for the label on the ports.

[tim_frodermann]

Hi, alright, that' s good to know. Could you please elaborate what I would have to do to use one of the internal ports for wan: - First of all, all LAN ports combined are the switch for the internal interface - I imagine i have to set up a new interface => I can choose vlan or software switch here - vlan might not bee suitable because i have no ways of tagging the pakets from the provider router - So i guess i have to go with software switch, right? Something like:

 config system switch-interface
 edit WAN3
 set type switch
 set member port10 (being the LAN port where the third provider router is attached to)
 end
 

Is that the right way to go? Thanks again, Tim

[Dave_Hall]

It would help if you provided the Fortigate model and firmware running on it. If the internal interface is in switch or interface mode or there is already a soft switch configuration on the Fortigate, you may need to break it. This topic comes up every now and then, you should be able to find examples on how to do this or provide more details about your the current " config system interface" section (san real IP addresses).

[tim_frodermann]

Hi Dave, you are right, but the thing is that there is no unit, yet. I' m merely planning a new setup for a customer. Customer wants to decomission some older fortigate units and buy new ones and in that process streamline some other things such as the use of their various internet connections. I was thinking about 90D' s, if there are no problems known, i would go for the latest firmware release. The 90D' s would be in switch mode as factory default. So did i understand correctly: - The first thing to do would be to switch the unit to interface mode - Then i can set up a new interface, selecting one of the 14 ports of the 90D (of course the one connected to the third dsl router) Is that the procedure, roughly? Bye, Tim

[Adrian_Buckley_FTNT]

A new 5.2 feature is the virtual wan link. It makes dealing with multiple Wan interfaces a lot easier to manage.

[tim_frodermann]

hi Adrian, thanks for the hint. Didn' t read about that new feature, yet. Will look into it. Thanks, Tim

[Dave_Hall]

Is that the procedure, roughly?

More or less. Though on the bigger units (on 5.x) you can create hard switches, which is nice. (Fortigate doesn' t have to directly handle the transfer of traffic between the port members). Can' t tell from the Specs if these newer smaller units have that feature. Was also planing to upgrade to the 90D once we retire our 80CMs (some time next year), but glancing at the product comparison chart for the smaller units, I' m not too impress with the 90D' s AV/IPS throughput when compared to the 80D (those numbers must be off?). You may want to consider going to a larger unit (e.g. 100D or 200D) or a unit with enough muscle to drive 5 x WAN port connections and expected throughput (with or without IPS/AV inspection). I would contact your local Fortinet dealer for sizing up the right Fortigate model for your client or the very least, ask for a demo unit for testing purposes.

[tim_frodermann]

Hi Dave, Hi Ede, i talked to the local dealer, he confirmed the numbers in the comparison matrix (same explanation as Ede provided). I think I will go for the 90D, because the 80D has just 4 RJ45 Ports total which is not enough for my needs (I need at least 5). The only bottleneck could be AV. If i want ports and fast AV there is no other possibility than choosing at least a 100D...and accepting a base price the double of a 90D :( . Thank you all for your help! Tim

[ede_pfau]

@Dave The 80D is a special device for high throughput AV. It' s CPU based so firewalling throughput is far less than in a 70D/90D (the 70D is a 90D without internal SSD). If your focus is on AV then a 80D will cope with high loads better than a 90D. This is typically the case with a pure gateway firewall. Whereas a 90D can be used to segment a (small to medium) LAN as well if you refrain from AV scanning.