WLLB contra Policies on WAN Interfaces - any advices?

[sw2090]

Heyho,

I have the following (not really uncommon *g*) setup:

FortiGate is connected to a router via one WAN Interface and to annother router via annother WAN.

Both WANs are in WLLB and doing some Loadbalancing.

Now let's say WAN1 has a static IP setup to reach that router and the WLLB knows the Gateway. Default Route is on WLLB.

Internet + WLLB works fine so far.

However it is impossible to create a policy granting access from somewhere inside to the Net the WAN1 is in because you cannot select WAN1 as destination nor source interface anymore.

I come in via remote by IPSec VPN and want to be able to access that router from here. That would require a policy at remote sinde but as I said I cannot create it.

Can anyone help me to understand why fortinet made this limitation? I cannot see any sense in not allowing this.

[Anurag_Goyal]

you can do all the things as you want but you need to share the model of FGT with version.

[sw2090]

This ist not a model specific issue. I encountered this on a 100D,100E,60E,90D,...

I'd consider it to be more a  "Feature" of FortiOS v5.4.x or greater.

It generally happens to you on v5.4.x (I don't have any v5.6.x so can't say if it is there too) and it does not matter which FGT model you have alas it is able to run 5.4.x of course ;)

[Anurag_Goyal]

"However it is impossible to create a policy granting access from somewhere inside to the Net the WAN1 is in because you cannot select WAN1 as destination nor source interface anymore."

1. Define the IP of your router in "Addresses" with particular interface.

2. Create the policy "Source-your inside interface with your desired user's ip/IPSec user or all", Destination-WLLB with your router's IP as you created.

that's it.

[sw2090]

Aah ok :) You never stop learning xD

Yes it does work that way! Many thx to you!

cheerioh

Sebastian

[Anurag_Goyal]

your welcome