dual wan with policy routes?

[#1]

hi all, i have this lan-situation: http://www.zebis.ch/dualwan.gif all traffic from clients must go out -> wan1 all traffic from webserver (dmz2) must go out -> wan2 all outside traffic with destination to webserver will come in -> wan2 on my FG-A100 2.08MR12 i did this with: - a static default route on each wan - and one policy route " incoming dmz2, outgoing wan2, src/dst 0.0.0.0/0.0.0.0" this worked fine since i made a update to 3.0 MR7P2 since that, some clients cannot go out. sniffering the FW tells me, the FW will drop ip-pakets... when i shut down wan2, everything works fine, but our webserver is off-line from the outside world.... any ideea how to solve this routing? i konw it can be done with vdom, but this means e complet redraw of the network, which i will do later... thanx, claudio

[red_adair]

make sure that both static 0.0.0.0/0 routes have the same metric. You can give one route a higher prio (through CLI) if needed (so in your case the route to wan1 will have higher prio and is sort of def-GW) I' d suggest not to use a ping server in a first step - not to introduce another piece of complexity in the beginning. You still need policies for both Interfaces of course. Make sure you do not have asymmetric routing. eg - if a " normal" packet from Lan is sount out through wan2 (maybe proxy is in DMZ?) than the back-packets may arrive on wan1 - which than are dropped as there is no state.

[#3]

yes, static routes are fine, same metric, no pingserver... firewall policies ar on both interfaces... routing policy is just one : incomming dmz2 -> outgoing ->wan2 do i need more routing policies??? which? thanx, claudio

[wcente]

Hello Minutella, for your scenario you need at first 2 static routes for your connection to outside (one for wan1 one for wan2), both must have the same distance, maybe 10. Then you have to add 4 policy routes, maybe your clients are on int1 and your webserver on dmz2 and you want the internal clients use wan1 and the dmz2 server should use wan2 only: Incoming WAN1 force to INT1 Incoming INT1 force to WAN1 Incoming WAN2 force to DMZ2 Incoming DMZ2 force to WAN2 Adjusting the two default routes to the same distance and making pol. routing as above will do your job... Going further: If you want to, you can also make a setup, that is dedicated source and destination ip range or maybe just force http traffic in and out by using the tcp 6 prot and http source and dest. ports for wan2 and leaving any other traffic handled by a default policy route to wan1.

[#5]

I am trying close to the same setup. But when you setup the policy routes, what do you enter for the gateway for the internal and dmz interfaces. Would it be the ip address of the fortigate for that interface? ex. internal network 192.168.1.0/24 fortigate would be 192.168.1.1 dmz 192.168.2.0/24 fortigate would be 192.168.2.1

[#6]

I just put 0.0.0.0 for the gateway per Fortinet' s recommendation -- this is a good article: http://kc.forticare.com/default.asp?id=376&SID=&Lang=1 Search on BLANK to see how they recommend configuring the policy route