Problem with 2nd network reaching internet

[dcs]

I'm definitely a beginner with Fortigate, but have some experience with stateful firewalls (from iptables). I'm setting up a system (Fortigate 30E) which should look like:

SD-WAN (wan + lan4) -> two different internet connections, select ports forwarded to Internal (below)

Local (lan3): Single computer that is a local server and responsible for most of our load (including stuff it forwards), unlimited outgoing connections via SD-WAN.

Lan (lan1 & lan2): connect to some WiFi routers; unlimited outgoing connections via SD-WAN, limited to select ports to Local.

My Configuration so far is outlined below. Note that I know I do not have rules to permit LAN to access anything on Local right now.

What works: Internet connections to Local for selected ports only; Local accessing internet; Load balancing with SD-WAN.

What Doesn't work: Lan accessing internet. Using the packet sniffer, I determined that for DNS requests going out from Lan, the returning packets from the nameserver (I tested with 8.8.8.8) are rejected by the Fortigate, with an ICMP response sent to the DNS server that the destination port is not accessible.

The same traffic from Local seems to work just fine.

Any thoughts on what I've done wrong, or how to identify what I've done wrong would be greatly appreciated.

Thanks,

Doug

(Names and addresses have been sanitized, and the number of ports reduced).

Network: lan (lan1 & lan2) Role LAN Addressing Manual nnn.nnn..1.99/24 DHCP server starting nnn.nnn.1.100 ending nnn.nnn.1.200 STP on local (lan3) Role LAN Addressing Manual nnn.nnn..2.1/29 DHCP server starting & ending at nnn.nnn.2.2 SD-WAN combines two interfaces wan2 (lan4) Role WAN Addressing Manual XXX.XXX.XXX.XXX to ISP1 (gateway configure in SD-WAN page) wan Role WAN Addressing Manual YYY.YYY.YYY.YYY to ISP2 (gateway configure in SD-WAN page) Static routes: 0.0.0.0/0            SD-WAN nnn.nnn.0.0/16    0.0.0.0        local (lan3) nnn.nnn.1.0/24    0.0.0.0        lan Virtual IPs: ip1: XXX.XXX.XXX.XXX tcp port 20 to nnn.nnn.2.2, interface any ip2: YYY.YYY.YYY.YYY tcp port 20 to nnn.nnn.2.2, interface any ip3: XXX.XXX.XXX.XXX tcp port 22 to nnn.nnn.2.2, interface any ip4: YYY.YYY.YYY.YYY tcp port 22 to nnn.nnn.2.2, interface any Virtual IP Groups ipg1: Interface lan4       Members ip1 and 1p3 ipg2: Interface wan       Members ip2 and 1p4 IP Pool (not used): nnn.nnn.2.100-nnn.nnn.2.200 Policies: 0: Implicit Deny (built in) 1: To Local  sd-wan -> lan3    Source all    Dest ipg1, ipg2    Schedule Always    Service All    Accept    NAT Disabled 2: To Internet lan3 -> sd-wan    Source all    Dest all    Schedule always    Service all    NAT Enabled    Use Outgoing Interface Address 3: To Internet2 lan -> sd-wan    Source all    Dest all    Schedule always    Service all    NAT Enabled    Use Outgoing Interface Address Observed lan -> sd-wan fails because (at least) DNS responses are rejected by Fortigate (which sends ICMP: Port Not Accessible to DNS server).

[orani · Accepted solution]

Try to place the rule with id 2 before (higher) the rule with id 1

[orani · Accepted solution]

On the upper right corner check the sequence view. Then check you rules priority. The rule wich is higher is the first to execute... then you can drag and drop the rule to move upper

[orani]

Try to set the rules with the following sequence 2,3,1,0. If that not work, then try to enable nat at policy 1

[dcs]

We have urgent network activity right now -- when I get a chance I'll try  your suggestions.

Thanks,

Doug

[orani]

Ok, but don't worry. You will not have any downtime doing those changes. Let us know when you do the tests.