Routing Problem with Fortigate 60C

[ITtech]

Hi,

I request your help for a routing configuration in my fortigate,

I have received a box from OVH (technicolor), in my firewall I have 2 box connected (the OVH box on wan1 and another box on wan2). the 2 box have the same settings and I put the same policy rules on the 2 interfaces. My problem is when I try to use my Voip phones they only take the way of the wan2, when I desactivate the "voip rule" on wan2, the rule on wan1 does not work.

To be clear about this, I want to use the wan1 for Voip only and the wan2 for web traffic and datas.. I put a policy route to wan1 but it does not seem to work. I have my system/config HA configured in standalone mode,

my heartbeat interface:

dmz enable 50 lan 0 wan1 enable 50 wan2 0 On My static route: the wan2 priority and distance are set on 10                              the wan1 priority and distance are set on 5 I tried with my box set on bridge mode also in routing mode, but the result is the same. Any idea about this problem ? I probably made a mistake in my configuration... Sorry for my poor english, thanks in advance for your assistance.

[emnoc]

The diag debug flow command is your friend. You say your using PBR have you ran the cmd using the single VoIP phone and see what outputs are delivered ?

e.g (assuming the phone is  a.b.c.d )

   diag debug dis

   diag debug reset

   diag debug enable

   diag debug flow filter addr a.b.c.d

   diag debug flow show console enable

   diag debug flow tract start 100

( now start some traffic from that phone a.b.c.d )

After you received any outputs, review the cause and final action to the flow in question. To disable the diagnostics

diag debug dis

I hope that helps and gets you started.

One more item;

My problem is when I try to use my Voip phones they only take the way of the wan2, when I desactivate the "voip rule" on wan2, the rule on wan1 does not work.

Dis-activating a fw-policy does nothing to  the routing information base, so the is above is what I would considered  normal and the rule isn't being matched or present on wan1. Once again diag debug flow will show you this.

Other things to check;

1> proper PBR  statements

(btw I'm not sure how you would do this with a VoIP that uses  pinholes for the RTP media path, but I don't think that a issue if i

2> if I understood your PBR is for wan2 and VoIP on wan1 )

 proper fwpolicies  ordering and including NAT where required

3> the gateway is up and operative for next-hops for wan1 and wan2

Ken

[Iescudero]

Hi! If  in WAN1 and WAN2 are both connected to a gateway with the same route (i.e ISP) like 0.0.0.0/0.0.0.0 then both routes may have same distance. Both 10 or 5 distance, if the distance are not the same, the fortigate only put the route with the less distance, and the other one is just used when the first one is not available.

Sorry for my bad english too :)

Tell us if it helps!

Regards!!

[ITtech]

Hi, Thank you for your answers. I set the same distance to wan1 and wan2 as you said. but all the traffic is only achieved by the wan2. As you said Ken "Dis-activating a fw-policy does nothing to the routing information base" So do you think I should delete the fw-policy on wan2 to make sure the traffic go to wan1. Is it possible to force the traffic for my "Voip fw-policy" to wan1 ? thanks

[Iescudero]

Hi there!

well, with same distance, both routes must be available.

Now, you want to send all your traffic just for a single interface like WAN1?

Then your config must be like this (this is just an example):

config router static

edit 1

set dst 0.0.0.0 0.0.0.0

set interface wan1

set distance 10

set priority 0

set gateway 192.168.1.1

next

edit 2

set dst 0.0.0.0 0.0.0.0.0

set interface wan2

set distance 10

set priority 10

set gateway 192.168.2.1

next

end

Now, all your traffic to the route 0.0.0.0 0.0.0.0 flow to WAN1, and if this interface its not working, then traffic flow to WAN2.

Now, just one more thing. supposed you want some traffic, not all of it go to WAN1 and some other traffic go to WAN2, wich means, you add a condition to your traffic. Its time to use a Route policy!

suppose you want only traffic from IP Phone (i.e: 172.16.10.10 connected to interface internal) go to WAN1 and the rest go to WAN2. then you must configure like this:

firts routes:

config router static

edit 1

set dst 0.0.0.0 0.0.0.0

set interface wan1

set distance 10

set priority 10

set gateway 192.168.1.1

next

edit 2

set dst 0.0.0.0 0.0.0.0.0

set interface wan2

set distance 10

set priority 0

set gateway 192.168.2.1

next

end

Then the policy Route

config router policy

edit 1

set input-device internal

set src 17.16.10.10 255.255.255.255

set dst 0.0.0.0 0.0.0.0

set gateway 192.168.1.1

set output-device wan1

next

end

Then all of your traffic go to wan2, and only 172.16.10.10 go to wan1. Policy routes only works if a route is active, wich means is in the routing table, and thats why both defaults routes must have same distance.

I hope i been clear and help you to understand a little bit more about Fortigate!

[ITtech]

hi again,

this is exactly what I want to do, specify one interface for all traffic excepted for Voip, that I want to be use by another interface. I have already set my config router static and my policy route just like you recommanded. It does not seem to work, but I have many "older policy route" made by my predecessor. I will try to clean this to have a configuration exactly like you said. Thank you for your help, that help me to understand ;)

[ITtech]

Hi Again, I have tried to change the sending address to an odd number and it does not change the gateway address. I also tried to change the priority of my routes, even if I put the prioty of wan1 to 0 and the priority of wan2 to 10 the traffic continue to pass to wan2. Is it possible that my box connected on wan1 is not compatible with fortinet? thx for the advise emnoc I will check the route table.

[rwpatterson]

By any chance, does the sending IP address end in an even number?

[ITtech]

Hi rwpatterson, Yes the sending IP address end in an even number

[rwpatterson]

If you change it to an odd number and the gateway changes, then it is the FGT doing 'gateway load balancing'. Even IP addresses use the WAN2 and odd IP addresses use WAN1. Test and let us know how it goes.