VIP using Static IP from WAN1, but shift Outgoing Traffic to WAN2? (SD-WAN / VIP)

[Emref]

Hello,

I recently installed a second WAN on my FortiGate 40F. I've been facing an issue I'm not able to resolve and looking for some help. I am a beginner though, so I'll try my best to explain my goal clearly and current

Goal:

- My wan1 has a bunch of static IPs, while wan2 doesn't have any. 

- I would like to access my file server via a static IP from wan1 from the internet (only wan1 has static IPs)

- I would like the application to only upload traffic via wan2 because it is 25x faster.

So, it should listen on wan1, but actually use wan2 only for data transmission. 

Current Setup:

- Configured SD-WAN and added both members. WAN2 has a higher priority, and in general it is being used most of the time, which is good for me. - working fine

- Created VIP for my server (external 37.37.37.37, internal 192.168.5.111) - working fine

My Policies: 

- SD-WAN to LAN (source all, destination VIP)

- LAN to SD-WAN (source all, destination all)

FOUND SOLUTION - Thank you everyone!:

Possible solution was to create DDNS and necessary firewall policies with that for dynamic/non-static IP.

- In my case: I got 1 static IP as well from my WAN2 ISP. My ISP router was giving me a local address & I can't configure it manually; it has to be DHCP.

- Solved by creating a DMZ for the Fortigate on the ISP router. Then, creating firewall policies & VIPs using the Fortigate IP address ON THE ISP ROUTER (192.168.118.4 in my case).

Thanks again everyone! A very pleasurable experience here, my first time on the forum!

[Emref]

Yes, the public IP is getting resolved correctly. The DDNS is getting the correct IP.

When I sniff for packets "diagnose sniffer packet", nothing is hitting the firewall... but all other static IPs and ports from wan1 are getting traffic.. Not sure why this is happening.. 

[Dhruvin_patel · Accepted solution]

Greetings!

In this case create a port forwarding on ISP router, https://www.hellotech.com/guide/for/how-to-port-forward

ISP router should translate the traffic from public IP to private IP of FortiGate.

Thank You!

[Emref]

Thank you so much!

After enabling Port Forwarding (I set up a Virtual Server and opened all ports one by one), I am now finally able to receive traffic. 

I actually set it up as a DMZ to get all ports open to the Fortigate.

Now its another issue I'm encountering at the moment:

- VPN server say its listening at 192.168.10.10:7777 on wan2 for example. I am able to connect it to by going to 37.37.37.37:7777 now.

- I can connect to the VPN, but I am not able to RECEIVE any data; but it is successfully sending data to through the VPN.

- Should I be adding any specific firewall policy? For my policies, should I be treating it as 192.168.118.4 (which is the fortigate IP on the ISP router?) .. or should I add the static IP? i don't believe adding the static IP is working

SOLVED: Added VIP for 192.168.118.4 instead of the public IP.. everything is working now.

Thank you everyone!

[NimbleIT]

Thanks for sharing this! I had to also create a port forwarding on the ISP's router end as well! Even though DMZ was setup to forward everything to the FGT, it wouldn't work. Once I created a port forwarding as well on the ISP's router (to point to internal IP of FGT), the VIP started working! Thanks for sharing.