Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
kxs
New Contributor

dual WAN 1 Tunnel

Hello, I have a big problem. The HQ has two WANs with 2 different ISPs.
I would like to route the HQ's Internet traffic over WAN1 and create a tunnel to the branch office over WAN2.

The problem is that as soon as I enable WAN2 all clients from LAN1 try to connect over WAN2.

The configuration here:

WAN1 = Network > Interfaces > ppoe = O.K
WAN2 = Network > Interfaces > ppoe (VLAN40) = O.K
Static Route > Destination = 0.0.0.0 0.0.0.0> Interface = WAN1 > Distance 5 > Priority=0
Static Route > Destination = IP of Branche/32 > Interface = vlan40 > Distance 5 > Priority=3

IPSEC Tunnel to Branche = Up

Policy from LAN1 > VLAN40 = disabled
Policy from LAN1 > WAN1 = outgoing all enabled

Log > Forward Traffic > all Clients from LAN1 try to use Destination Interface VLAN40 > implicit Deny

I tried diag ip rtcache flush > no success

All clients from LAN1 use outgoing interface VLAN40 until I disable the interface

What is wrong?

6 REPLIES 6
AEK
Honored Contributor

AEK
Toshi_Esumi
Esteemed Contributor III

As @AEK suggests, policy routing is one way to accomplish.

 

Another way to accomplish without policy routes is:
1. "set defaultgw disable" on both wan1 and wan2(VLAN40) interface config

2. set a simple static default route to wan1 and another static default route with higher priority number (lower priority) like 10 to wan2:
config router static

  edit 0

    set device wan1
    set dynamic-gateway enable

  next

  edit 0
    set device VLAN40

    set dynamic-gateway enable

    set priority 10

  next

end
At this point, all HQ users internet should go out to wan1 if the default policy exists

3. set up your IPsec VPN to branch by specifying wan2(VLAN40)

4. set more specific routes for branch office's subnets toward the tunnel interface

5. Then set up proper policies for traffic to branch(es)

And, the third option is to set up SD-WAN and build up rules to route sperifically. This is more advanced/controllable policy routing.

 

In other words:
option1 - good old "FW" guy's way

option2 - good old "Router" guy's way

option3 - newer "SD-WAN" guy's way

Toshi

AEK
Honored Contributor

@Toshi_Esumi , so I'm the good old FW guy? :D

AEK
AEK
Toshi_Esumi
Esteemed Contributor III

Then, I'm a good old router guy, of course. ;)

Toshi

kxs
New Contributor

good old "Router" guy's way is not working for me.

can not establish a tunnel. Only if distance the same.

Toshi_Esumi
Esteemed Contributor III

What do you have in the routing-table at the beginning? Below is my SD-WAN 40F's.

 

fg40f-utm (root) # get router info routing-t all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default

Routing table for VRF=0
S* 0.0.0.0/0 [1/0] via x.x.x.x, ppp3, [1/20]
                    [1/0] via y.y.y.y, a, [1/1]
<snip>

 

If it's a dynamic IP on wan2, you might need to set a DDNS and use the DNS name on the branch side as static/main mode IPsec to connect to wan2.

Toshi

Labels
Top Kudoed Authors