Route SSL VPN traffic

[jfernandez]

Hi

I'm new to fortinet. We have a fortigate 201E with 2 wans. I'm using both as Active-Passive using static route priority

I'm using active wan (wan1) interface for normal web traffic but I want passive interface (wan2) to be used for VPN. The problem is that incoming traffic comes from wan2 but the outgoing traffic routes through wan1 interface due to priority configuration

It's possible to route the incoming traffic that comes from wan2 through wan2 and not wan1?

thx!

[Toshi_Esumi]

WAN2's public IP from the ISP should be used to configure the other side of the VPN. Then it should work as you intend.

[ede_pfau]

I think you should looks into "Policy Routes". This is routes which do not only match destinations but source address and/or source, destination ports as well. Your SSL VPN should be unique enough to match only this traffic and divert it to WAN2.

[jfernandez]

Yes I tried to use policy routes but it didn't work. The only way I managed to work was to put a static route to the source ip address routing through the default gw of WAN2 but this is not a solution

thx all

[jfernandez]

I found this in a cookbook but it didn't work. I have configured a WAN LINK between the 2 wans because I want to apply policy to the wan link. When configuring ssl vpn settings in "listen interface" I can only select WAN LINK and not wan2. Maybe this is the problem?

Tunnel-mode connection shuts down after a few seconds.

This issue can occur when there are multiple interfaces connected to the Internet (for example, a dual WAN). Upgrade to the latest firmware then use the following CLI command:

config vpn ssl settings
   set route-source-interface enable
end

[jfernandez]

updating :D

problem solved. I have two default routes for HA, one por wan1 weighted 10 and one for wan2 weighted 20. I modify wan2 and weighted equal as wan1 et voilá!!

thx all