Multiple WANs for separate LANs

[LEO08]

We are using a Fortigate 60D in our work place. The 60D is used as our UTM/core router and is using one WAN link to provide internet access. The company plans to add a second firm in the current location. The new firm will have a separate internet connection for its users. The plan is to setup 2 VLANS, one for the current business and the second for the new firm and create my policies according to business’s needs. My question is can(and how) I setup the fortigate to route internet traffic out separate WAN interfaces according to the VLANs being used?

Thanks

[SCSIraidGURU]

Not sure why you would not link balance the two WANs for redundancy.   So you have WAN 1 and WAN 2 separate.  Yes, you could create policy for traffic out either one.  I set my 800C to link balance the two 20 Mbps WAN ports.   Exchange has MX record on both.  WAN 1 has a lower metric to be primary for it.   HTTP and HTTPS link balance round robin.  SSO traffic to our banks are WAN2 first, WAN1 second in a fail over mode.   Only thing is make sure the latency on both are about equal to link balance.  The only issue would be a DDOS attack or WAN down issue that would stop traffic going out. 

[tanr · Accepted solution]

There are multiple ways you can do this.  These vary somewhat if you're running 5.2.x or 5.4.x.

Solutions will vary depending on how the businesses are connected and what services they require.  Are they each connected with their own switches and routers, or are they all plugging into the same switch?  Do their users need to be able to VPN in?  Are they running their own servers that need to be publicly exposed?  Are they handling their own wifi needs?  Etc. etc.

If the companies both need to be able to manage "their" part of the FortiGate, then you may need to use VDOMs.  An example of this is at http://cookbook.fortinet.com/vdom-configuration-54/.

If you're doing all the management, as long as the two companies are on different physical switches, you can keep them on separate physical interfaces, each with their own subnet.   If they're all on the same switch at some point, then vlans on a managed switch are a safer way to keep things separated.  There are a number of examples of this in the forums and the KB and cookbook.  The FortiOS 5.4.x admin guide has a section named "Example VLAN configuration in NAT mode" if you haven't worked with them before.  

Routing the different companies networks, based on their vlans or subnets, out the different WANs can be done with policy routes (source based routing).  The way to do this is a bit different if you are on 5.4.x or 5.2.x.

[sp00n]

tanr wrote:

There are multiple ways you can do this.  These vary somewhat if you're running 5.2.x or 5.4.x.

Solutions will vary depending on how the businesses are connected and what services they require.  Are they each connected with their own switches and routers, or are they all plugging into the same switch?  Do their users need to be able to VPN in?  Are they running their own servers that need to be publicly exposed?  Are they handling their own wifi needs?  Etc. etc.

If the companies both need to be able to manage "their" part of the FortiGate, then you may need to use VDOMs.  An example of this is at http://cookbook.fortinet.com/vdom-configuration-54/.

If you're doing all the management, as long as the two companies are on different physical switches, you can keep them on separate physical interfaces, each with their own subnet.   If they're all on the same switch at some point, then vlans on a managed switch are a safer way to keep things separated.  There are a number of examples of this in the forums and the KB and cookbook.  The FortiOS 5.4.x admin guide has a section named "Example VLAN configuration in NAT mode" if you haven't worked with them before.  

Routing the different companies networks, based on their vlans or subnets, out the different WANs can be done with policy routes (source based routing).  The way to do this is a bit different if you are on 5.4.x or 5.2.x.

Hi, sorry for diggin this thread up, but I have somehow complementary question to what you have written. Everything described is perfectly clear to me. The problem appears when we start to think about WAN redundancy for accessing Internet (so outgoing traffic). Seems that with two company scenario each having its OWN primary WAN and using the others company WAN as a backup line we are not able to provide a failover function without using load balancing feature, is that correct?

[tanr]

First question should be: Are those two companies okay with you using their WAN ISP as failover for the other company!  If they are not then you don't want to do any of this.

If your two companies each have their own VDOM having failover to a wan on the other VDOM would get a little more complicated - haven't tried that myself, but I would think it is doable.

If your two companies are on the same VDOM, and you're separating them by physical interface or by vlan, then you can still provide failover without needing to use load balancing.  See https://forum.fortinet.com/tm.aspx?m=146282 for a similar discussion (it starts in Spanish but then changes to English).  Also https://forum.fortinet.com/tm.aspx?m=147125 has similar info.  Note that this all gets more complicated if the two companies have publicly accessible servers, VIPs, VPNs, etc.

A short example of this:

Company A has their lan on FGT interface port3, subnet is 10.10.10.0/24.

Company A traffic normally goes out interface wan1.

Company B has thier lan on FGT interface port4, subnet is 10.20.20.0/24

Company B traffic normally goes out interface wan2.

First off, set up link health monitors for both wan1 and wan2 (cli command config sys link-monitor) so that when those interfaces go down the routing tables actually get updated.

Now set up two static default routes to wan1 and to wan 2, both with the same distance of 10, but with different priorities, priority of 5 for the wan1 route and 20 for the wan2 route.  This will mean both routes get added to the routing table (while the wan1 and and wan2 interfaces are live) but only the higher priority (smaller number) route with the priority of 5 will get used.  So right now all traffic that isn't more specifically routed will go out wan1.

Now add a single policy route, which specifies a source subnet of 10.20.20.0/24 (Company B) and a destination interface of wan2 (don't specify a gateway address - use 0.0.0.0).  The policy route is hit before your static routes and thus forces traffic from the Company B subnet out the lower priority route to wan2.  Note that this only works if that route is in the routing table.  That's why we added it with the same distance but a lower priority (larger number).

Now, if wan1 goes down your link-monitor for it will remove any static routes that reference it from the routing table.  In that case, traffic from Company A will just use the lower priority route out wan2.  Traffic from Company B will continue to use the same route out wan2 as well.

If wan2 goes down, your link-monitor will remove the static route to wan2.  In that case, traffic from Company A will continue out wan1 as before.  Traffic from Company B will match to the policy route that specifies wan2, but since their is no route with wan2 left in routing table the policy route will have no effect.  Instead the static route out to wan1 will get used.

[sp00n]

thanks for the info, did not really thought about this approach... will that configuration automatically update its static routes when e.g. not working WAN2 will be brought back online?  

[tanr]

My understanding is that it should update its static routes once WAN2 comes back online.  I tested this a while back, and seem to remember that it took a little while for the route to reappear, but I don't recall how long it took.