Multi-WAN with Virtual IPs tied to public IP on one link only?

[rharland]

We're lighting up a second ISP connection on one of our 200Ds. Currently, we have a few virtual IPs configured on the firewall for public services, and these are tied to one provider as one might expect.

As I read multi-WAN instructions, I'll need to nuke all policies and routes to the separate ISP connections, create the load-balanced entity, and rebuild policies and routes accordingly. Fairly straightforward. 

What I'm having trouble discovering is how I can make these virtual IPs still work for external-facing services. Do I need to simply redefine the virtual IPs with a different interface mapping (in other words, from WAN1 to WAN_loadbalance) and leave everything else the same, or are there additional steps that need to be taken?

Thanks for any info.

[ericli_FTNT]

Hi, can you provide an example so that I could give you a config sample. Thanks!

[rharland]

Sure!

So let's say we've had ISP1 as the sole provider up until now. From this provider, we get some public IP addresses. We'll call these addresses 4.4.4.0/29 or something like that. We have a public-facing server that uses 4.4.4.4 on the public side, and has an internal address of 10.100.100.4. So, for outside-in traffic, we configure an appropriate rule and build a virtual IP that maps 10.100.100.4 to 4.4.4.4, and configure that virtual IP to use ISP1 on WAN1, and for egress traffic sourced from the server we build an IP pool that references that same IP address. Fair enough.

Now, we get a second provider - ISP2 - and we decide we'd like to do multi-WAN loadbalancing. Based on the docs, I know I'll need to 1) remove any routes pointing to either the WAN1 or WAN2 interfaces and b) remove any policies that point to either interface - since I can't build the multi-WAN entity in the config if either interface is referenced explicitly, and building that virtual multi-wan interface is the first step in the process.

So, with that said, can I implement multi-WAN and still use virtual IPs/IP pools that are specifically tied to a single provider? I don't want to lose that functionality. My guess is that I could amend the virtual IP entry to point to 'any' interface instead of the separate WAN interfaces, but I don't know that to be true as of yet.

Hope this helps, and thanks for the response.

[ericli_FTNT]

Got your point. I will switch to this as my very next task. Get back to you soon.

[ericli_FTNT]

Ok, before you configured multi-wan link, I assumed you could configured vip well. So, let's focus on multi vip pointing to multi servers from multi-wan:

1. Two internal servers: web server 192.168.4.205 and ftp server 192.168.4.204

2. Two wan interfaces: wan1 10.1.100.130/24, wan2 172.16.200.130/24

3. Virtual-wan-link to load-balance between wan1 and wan2 :

[code lang=css]config system virtual-wan-link
    set status enable
    config members
        edit 1
            set interface "wan1"
            set gateway 10.1.100.254
            set priority 100
        next
        edit 2
            set interface "wan2"
            set gateway 172.16.200.254
            set priority 200
        next
    end
end

4.  Depends on your design, if you only allow access to web server via wan1, and ftp server via wan2, then:

 [code lang=css]config firewall vip
    edit "web_server"
        set extip 10.1.100.135
        set extintf "wan1"
        set mappedip "192.168.4.205"
    next
    edit "ftp_server"
        set extip 172.16.200.135
        set extintf "wan2"
        set mappedip "192.168.4.204"
    next
end

and apply these 2 vip into your policy:

config firewall policy     edit 1         set srcintf "virtual-wan-link"         set dstintf "server_link"         set srcaddr "all"         set dstaddr "web_server"         set action accept         set schedule "always"         set service "ALL"         set nat enable     next     edit 2         set srcintf "virtual-wan-link"         set dstintf "server_link"         set srcaddr "all"         set dstaddr "ftp_server"         set action accept         set schedule "always"         set service "ALL"         set nat enable     next end

5. If you need to allow wan1 - server2, wan2-server1, create two more new vip could be an easy way.