WAN2 on 60D

[KW]

Hi there,

We're currently using FortiWiFi 60D, running OS v5.0 build 4459.

We previously has one internet line connected to WAN1 with a fixed IP - say 172.1.2.10 ; All internet traffic is working fine with a static route for 0.0.0.0 to WAN1.  External parties can Ping this IP successfully.

Now we added a 2nd internet line, again with a fixed IP - say 172.1.2.20.  The line was installed and we've set up a laptop with the given IP, submask and DNS details and connected to the modem. All is working fine, the laptop an browse internet and can be Ping from external.

However, when I set up the fixed IP on WAN2 port and connected WAN2 to the modem. I cannot Ping the IP address from external parties.  The line status is up and all seems working.

Do I have to do other set up? or need to upgrade the OS?

Thanks,

KW

[Toshi_Esumi]

Your pinging from outside is coming into WAN2 but the response is trying to go out WAN1 by following the default route, but dropped because of asymmetric route. If you're just testing, you can set a /32 route toward WAN2 for the ping source. But you likely want to set at least another default route with higher priority value (the higher, the lower the priority is) like 10 via CLI toward WAN2, so that WAN2 would act as a backup internet.

If you want to set load-balancing, there are other documentations available. I would just google it.

[KW]

Thanks for your reply Toshi.

I've now added another default route for 0.0.0.0 to WAN2, with priority = 10. The original default route for WAN1 has priority = 0. Both have distance = 10.

I've also added another policy to all internal LAN to allow ALL thru WAN2 interface too.

I tried to ping the WAN2 line's gateway IP, and it ping successfully. The Policy screen on Firewall also shows increasing number of packets going thru that WAN2 policy.

I tried to ping the fixed IP on WAN2 interface from internal, but ping failed.

I can ping the fixed IP on WAN1 interface successfully from internal and also from outside.

Ping to WAN2 IP also failed from outside.

I'd more research on google, and all was suggesting just needing to add default route and duplicate the policies - which I did. I don't need to set up failover, as all I want is a NAT thru WAN2 IP to an internal web server.

Just not sure why it still fail, and any suggestions?

Thanks,

KW

[Toshi_Esumi]

doublecheck 1) ping is allowed on WAN2 interface, then 2) any trusthosts are configured. If so you need to add the ping source to it. Likely 2). Pinging interface doesn't require a policy.

To allow just one web site to go through WAN2, you don't need the default route but need a specific static route toward WAN2.

[Magesh]

Hi,

Are you setting two lines for the redundancy purpose?

[ede_pfau]

@Toshi:

I disagree about not having to have a second default route. If a packet arrives on WAN2, it's source address is unknown to the FGT. The destination address may or may not be NATted by a VIP, this doesn't matter in this context. The FGT will drop the packet because of unknown origin (reverse path check failure).

To cover ALL conceivable addresses, you need a default route.

@KW:

Pinging successfully is second to being able to reach the internal server successfully. You haven't posted if you can do that or not. If you use a VIP, it won't forward ICMP by default. In FortiOS v5.4 you can enable ICMP forwarding in the VIP setup (CLI).

Again, for being able to ping the FGT's WAN interface 'ping' must be allowed in the interface setup ('allow access'). And of course trusted hosts apply if configured.

[Toshi_Esumi]

I just picked up KW's statement "all I want is a NAT thru WAN2 IP to an internal web server." He didn't mention about sessions in out-to-in direction initiated by other outside parties. I assumed all sessions through WAN2 is from in-to-out only initiated by internal users/devices as well. If that's really the case as long as the FG has a route (and a policy) to the destination (could be /32) the FG doesn't need to know to reach other destinations on the internet through WAN2. They would go out through WAN1 with the original default route.

[Toshi_Esumi]

I'm so sorry. I read is as "an Internet web server" instead of "an Internal web server". I was wrong. You need a default route.

My apology.

[Gianluca_Caldi]

Hi KW,

a firmware upgrade is the first step I'd suggest. We also had a smimilar problem some time ago on a 60C and it turned out to be a firmware bug in managing  the "double wan routing". It was some 5.x version..

Now the box is running 5.2.6 and we got no problem anymore.

Bye

Gianluca

[ede_pfau]

At least it can't hurt to update to 5.0.13 (current). Stay with the 5.0 line (not 5.2) and please follow the recommended upgrade path - it might require intermediate firmware versions to keep the config intact. (Get hints from search in the forums "Upgrade Matrix").